@dsh-enhanced/assistant-delivery 0.1.65 → 0.1.67

package/lib/service.js

@@ -1,7 +1,10 @@
+import { engineeringContextData, validateWorkItemEngineeringMaterial, frameWorkItemEngineeringContext, pageWorkItemEngineeringContext } from './work-item-engineering-context.js';
+import { workItemReplyCanonical, workItemReplyDigest } from './work-item-replies.js';
 import { chmodSync, mkdirSync, readFileSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
-import { createHash, randomUUID } from 'node:crypto';
-import { Context, Service } from '@deepseek-ai/cordis';
+import { isProxy } from 'node:util/types';
+import { createHash, randomBytes, randomUUID } from 'node:crypto';
+import { Context, Service, symbols } from '@deepseek-ai/cordis';
 import Schema from '@deepseek-ai/schemastery';
 import { RestartStore } from './restart-store.js';
 import { restartDigest } from './restart-runtime.js';
@@ -22,12 +25,15 @@ import { NativeWebOwner } from './native-web-owner.js';
 import { validateOwnerGoalOutcomeFeedbackLocator, validateOwnerGoalOutcomeFeedbackProof, } from './goal-wake-types.js';
 import { isSynchronousForegroundObservationHandle, validForegroundObservationRegistration } from './foreground-observation.js';
 import { InboundImageMaterializer } from './inbound-images.js';
+import { assessAttention, assessAttentionSplit, attentionOverCap, attentionSplitWindowMs, convertOverCapAttention, NOTIFICATION_OUTCOME_FACTS_PROTOCOL, linkedReportKeyPrefix, linkedReportMetadataPrefix } from './attention.js';
+import { ProgressAttentionAudit } from './progress-attention.js';
+import { AttentionRejectionLog, attentionEnforcementReasons } from './attention-enforcement.js';
 import { registerDeliveryTools } from './tools.js';
 import { bindingMatchesOwnerRoute, canonicalBackgroundSourceId as canonicalHostBackgroundSourceId, canonicalConversation, canonicalLocalOperatorId, canonicalOwnerRouteAuthority, externalPrincipalId, ownerRouteAuthorityHash, ownerRouteBindingSnapshot, } from './canonical.js';
 import { isExactDeliveryCommand, parseDeliveryCommand } from './session-commands.js';
 import { deliveryT1PreferenceKeys, deliveryT1PreferenceValues } from './learning-command.js';
 import { assertReplyReplayAllowed, blockAgentRepliesForReplay as createReplyReplayBlock, } from './reply-replay.js';
-import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
+import { feedbackSignalInput, parseFeedbackCommand, parseNaturalObjectiveFeedback, parseNaturalOwnerReply, objectiveStateMessage, classifyNaturalPreferenceDirective, observedResponseLanguage, } from './feedback-command.js';
 import { DELIVERY_PREFERENCE_PROJECTION_PROTOCOL, TRUSTED_DELIVERY_PRESENTATION_PRODUCER_PROTOCOL, } from './types.js';
 const trustedDeliveryPreferenceProducers = new WeakSet();
 const deliveryPreferenceProducerProbe = Symbol('assistant-delivery.preference-producer-probe');
@@ -242,9 +248,24 @@ function validateLearningControlReceipt(value, request) {
         throw new Error('learning rollback receipt is invalid');
     }
 }
+function workItemPeerIdentity(value) {
+    if (value === null || (typeof value !== 'object' && typeof value !== 'function'))
+        return value;
+    try {
+        return Reflect.get(value, symbols.original) ?? value;
+    }
+    catch {
+        return value;
+    }
+}
+/** Cordis service slot names that may own an owner-notice withdrawal check. */
+const ownerNotificationAuthorityPattern = /^[A-Za-z][A-Za-z0-9]{0,63}$/u;
+function ownerNotificationWithdrawalKey(authority, sourceId) { return `${authority}\u0000${sourceId}`; }
 function containsReservedLearningMetadata(metadata) {
     return metadata !== undefined && Object.keys(metadata).some(key => key.startsWith(learningMetadataPrefix));
 }
+export const ownerNotificationWithdrawalProtocol = 'assistant-delivery/owner-notification-withdrawal/v1';
+export const ownerNotificationReplyProtocol = 'assistant-delivery/owner-notification-reply/v1';
 export class AssistantDeliveryError extends Error {
     code;
     constructor(code, message) {
@@ -253,6 +274,17 @@ export class AssistantDeliveryError extends Error {
         this.name = 'AssistantDeliveryError';
     }
 }
+/** WP19 stage 3 rejection: `policy-denied` with structured reason codes; nothing was queued. */
+export class AttentionRejectedError extends AssistantDeliveryError {
+    rejection;
+    reasons;
+    constructor(rejection, message = `attention rejected: ${rejection.reasons.join(', ')}`) {
+        super('policy-denied', message);
+        this.rejection = rejection;
+        this.name = 'AttentionRejectedError';
+        this.reasons = rejection.reasons;
+    }
+}
 function isOwnerAnchoredGoalsCapability(value) {
     return typeof value === 'object' && value !== null
         && typeof value.inspectOwnerVerifiedWorkflowSource === 'function'
@@ -304,6 +336,19 @@ const configSchema = Schema.object({
     permissionPickerTtlMs: Schema.number().step(1).min(60_000).max(86_400_000).default(900_000),
     toolApprovalTtlMs: Schema.number().step(1).min(1_000).max(300_000).default(300_000),
     toolApprovalPreparationTimeoutMs: Schema.number().step(1).min(100).max(30_000).default(10_000),
+    attentionAttachOverCap: Schema.boolean().default(false),
+    attentionEnforce: Schema.boolean().default(false),
+    ownerReportRouting: Schema.object({ orderAcrossLanes: Schema.boolean().default(false) }),
+    naturalFeedback: Schema.object({
+        coverage: Schema.boolean().default(false),
+        mixedIntent: Schema.boolean().default(false),
+    }),
+    peerAgents: Schema.array(Schema.object({
+        channel: Schema.string().min(1).required(),
+        account: Schema.string().min(1).required(),
+        tenant: Schema.string().min(1).required(),
+        user: Schema.string().min(1).required(),
+    })).default([]),
     ownerRoutes: Schema.array(Schema.object({
         id: Schema.string().min(1).required(),
         conversation: Schema.object({
@@ -372,6 +417,8 @@ function pickerIncludesRoute(picker, route) {
     const model = picker.models.find(candidate => candidate.provider === route.provider && candidate.id === route.model);
     return model !== undefined && (route.reasoningEffort === undefined || model.effortIds.includes(route.reasoningEffort));
 }
+/** UTF-16 bound on transient inbound text forwarded to an opted-in intake observer. */
+const MAX_INBOUND_INTAKE_TEXT = 65_536;
 const MODEL_SELECTION_WAIT_POLL_MS = 500;
 const MODEL_SELECTION_WAIT_TIMEOUT_MS = 120_000;
 function isModelSelectionPayload(value) {
@@ -397,6 +444,8 @@ function isModelSelectionPayload(value) {
 const toolApprovalArgumentBytes = 16 * 1024;
 const ownerRequestedChangeArgumentBytes = 64 * 1024;
 const toolApprovalIdentityBytes = 512;
+/** Bounded owner-ordered linked fallback list for one report route. */
+const maxLinkedReportFallback = 8;
 function inspectUnsettledNativeCall(events, turn, callId, toolName, argumentsJson, argumentBytes = toolApprovalArgumentBytes) {
     if (!callId || !toolName || Buffer.byteLength(callId) > toolApprovalIdentityBytes
         || Buffer.byteLength(toolName) > toolApprovalIdentityBytes
@@ -580,6 +629,39 @@ function exactToolApprovalCall(events, openTurn, callId, toolName) {
         return undefined;
     return exact;
 }
+/** Reject peer/caller accessors before any source locks or final local comparisons. */
+function learningSourceData(value) {
+    const ancestors = new Set();
+    let nodes = 0;
+    const visit = (part, depth) => {
+        if (part === undefined || part === null || typeof part === 'string' || typeof part === 'boolean' || typeof part === 'number' && Number.isFinite(part))
+            return;
+        if (!part || typeof part !== 'object' || isProxy(part) || depth > 24 || ancestors.has(part) || ++nodes > 100_000)
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid learning source data');
+        const array = Array.isArray(part), prototype = Object.getPrototypeOf(part);
+        if (prototype !== (array ? Array.prototype : Object.prototype) && prototype !== null)
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid learning source prototype');
+        ancestors.add(part);
+        for (const key of Reflect.ownKeys(part)) {
+            const descriptor = Object.getOwnPropertyDescriptor(part, key);
+            if (array && key === 'length')
+                continue;
+            if (typeof key !== 'string' || !descriptor.enumerable || !Object.hasOwn(descriptor, 'value'))
+                throw new AssistantDeliveryError('runtime-conflict', 'learning source accessors are not accepted');
+            visit(descriptor.value, depth + 1);
+        }
+        ancestors.delete(part);
+    };
+    visit(value, 0);
+    const freeze = (part) => { if (part && typeof part === 'object') {
+        for (const child of Object.values(part))
+            freeze(child);
+        Object.freeze(part);
+    } };
+    const copy = structuredClone(value);
+    freeze(copy);
+    return copy;
+}
 export class AssistantDeliveryService extends Service {
     static Config = configSchema;
     deliveryStore;
@@ -619,14 +701,36 @@ export class AssistantDeliveryService extends Service {
     preferenceProducerGeneration = `assistant-delivery-preference:${randomUUID()}`;
     acceptanceProducerGeneration = `assistant-delivery-acceptance:${randomUUID()}`;
     acceptanceSink;
+    workItemReplyConsumer;
+    inboundIntakeObserver;
+    /** Send-time withdrawal checks for `withdrawable` owner notices, one per (authority, canonical source id). */
+    ownerNotificationWithdrawals = new Map();
+    /** Live handles issued by `registerOwnerNotificationWithdrawal`, mapped to their (authority, source) key. */
+    ownerNotificationWithdrawalHandles = new Map();
+    /** Slice-5 reply consumers, one per (authority, canonical owner-notice source id). */
+    ownerNotificationReplies = new Map();
     foregroundObserver;
     /** Once a live verifier required acceptance, loss of that verifier must not silently bypass it. */
     acceptanceRequired = false;
     preferenceTurns = new WeakMap();
+    /** Claimed human turns of linked owner aliases; read-only alias inspection only. */
+    // Alias turns pin the alias principal row version and link target observed at
+    // claim time; a re-link (which bumps the principal version) invalidates them.
+    aliasTurns = new WeakMap();
     goalWakeResults = new WeakMap();
     modelSelectionFlight;
     presentationFlight;
     workflowTraceFlight;
+    workItemFeedbackFlight;
+    workItemFeedbackCursor = 0;
+    workItemFeedbackAckCursor = 0;
+    /** WP19 stage 1: audit writes never affect delivery; failures are counted in this process only (reset on restart). */
+    attentionAuditWriteFailures = 0;
+    /** WP19 stage 2c: process-local progress attention audit (no Delivery schema change). */
+    progressAttentionAudit = new ProgressAttentionAudit();
+    progressAttentionAuditFailures = 0;
+    /** WP19 stage 3: process-local rejection log (rejected notices have no Outbox row). */
+    attentionRejections = new AttentionRejectionLog();
     naturalObjectiveFlight;
     preferenceProjectionFlight;
     inboundAdmissionRecoveryFlight;
@@ -721,19 +825,24 @@ export class AssistantDeliveryService extends Service {
         }
         ctx.on('agent/inbox/claimed', ({ agent, message, turn }) => {
             this.capturePreferenceTurn(agent, message.source, turn);
+            this.captureAliasTurn(agent, message.source, turn);
         });
         ctx.on('agent/inbox/discarded', ({ agent }) => {
             this.preferenceTurns.delete(agent);
+            this.aliasTurns.delete(agent);
         });
         ctx.on('agent/status', ({ agent, status }) => {
-            if (status === 'idle')
+            if (status === 'idle') {
                 this.preferenceTurns.delete(agent);
+                this.aliasTurns.delete(agent);
+            }
         });
         this.registry = new DeliveryAdapterRegistry({
             accept: async (envelope) => {
                 const result = await this.acceptInbound(envelope);
                 return { duplicate: result.duplicate, inboxId: result.inboxId, status: result.status };
             },
+            observe: observation => this.observeInbound(observation),
             receipt: async (receipt) => {
                 if (!this.active)
                     return;
@@ -843,13 +952,21 @@ export class AssistantDeliveryService extends Service {
                 authorizePermissionReply: (binding, envelope) => this.authorizePermissionReply(binding, envelope),
                 beginModelCommand: conversation => this.deliveryStore.beginModelCommand(conversation),
                 commitModelCommand: input => this.deliveryStore.commitModelCommand(input),
-                progress: async (binding, eventId, update) => {
+                progress: async (binding, eventId, update, origin) => {
+                    // WP19 stage 2c: audit only; the send path below is unchanged.
+                    try {
+                        this.progressAttentionAudit.record({ bindingId: binding.id, eventId, origin, update });
+                    }
+                    catch {
+                        this.progressAttentionAuditFailures += 1;
+                    }
                     const adapter = this.registry.get(binding.conversation.channel, binding.conversation.account);
                     await adapter?.progress?.({
                         bindingId: binding.id,
                         target: { conversation: binding.conversation, principal: binding.principal },
                         eventId,
                         update,
+                        origin,
                     });
                 },
                 replyCommand: (binding, eventId, reply, idempotencyKey) => {
@@ -908,6 +1025,9 @@ export class AssistantDeliveryService extends Service {
             this.start();
         ctx.effect(() => async () => {
             this.active = false;
+            // Disarm the scheduler before the first await: the Web owner drain can
+            // take seconds, and an armed tick must not run against a disposed service.
+            this.clearSchedulerTimers();
             // The isolated Web owner may already be unwinding concurrently. Await
             // its memoized drain while the delivery Store is still available so a
             // successfully disposed Agent can record its quiescent lease release.
@@ -916,6 +1036,7 @@ export class AssistantDeliveryService extends Service {
             this.preferenceFeedbackSink = undefined;
             this.acceptanceSink = undefined;
             this.foregroundObserver = undefined;
+            this.workItemReplyConsumer = undefined;
             this.evaluationSink = undefined;
             this.workflowTraceSink = undefined;
             this.automationPresentationBinding?.dispose();
@@ -1531,7 +1652,7 @@ export class AssistantDeliveryService extends Service {
             throw new AssistantDeliveryError('runtime-conflict', 'scheduled goal result exceeds the delivery text limit');
         }
         const situation = goalDefinitionSituation(proof.goal.definitionDigest);
-        return this.deliveryStore.enqueueGoalOutcomeTarget({
+        return this.auditAttention('scheduled-goal-result', 'assistant-goals-wake/v1', { lanePurpose: { purpose: 'result' } }, this.deliveryStore.enqueueGoalOutcomeTarget({
             locator, proof,
             intent: {
                 idempotencyKey: `goal-outcome:${proof.proofDigest}:${finalBinding.id}`,
@@ -1547,7 +1668,7 @@ export class AssistantDeliveryService extends Service {
                     'dsh.learning.proofDigest': proof.proofDigest,
                 }),
             },
-        });
+        }));
     }
     /** A textless terminal Web wake may notify its original owner, never impersonate a reply. */
     publishScheduledGoalCompletionNotice(input, current, denied) {
@@ -1561,6 +1682,8 @@ export class AssistantDeliveryService extends Service {
                 principalVersion: locator.principalVersion, workspace: locator.workspace, preset: locator.preset },
             sessionId: locator.sessionId, idempotencyKey, text: goalWakeCompletionNotice,
             expiresAt: Math.min(input.deadlineAt, proof.receipt.validUntil),
+            // Host-authored result notice: the Host always declares its purpose (WP19).
+            attention: { purpose: 'result' },
         });
     }
     resolveScheduledGoalOutcome(input, current, denied) {
@@ -1979,9 +2102,11 @@ export class AssistantDeliveryService extends Service {
             complete: (handle, input) => this.completeForegroundTaskAcceptance(handle, input),
             beginExecution: (binding, envelope) => this.beginForegroundTaskExecution(binding, envelope),
             completeExecution: (inboxId, input) => this.completeForegroundTaskExecution(inboxId, input),
+            recordExecutionModelSelection: (inboxId, input) => this.deliveryStore.recordForegroundExecutionModelSelection({ inboxId, ...input }),
             claimed: (agent, envelope, turn) => this.capturePreferenceTurn(agent, { kind: 'delivery', channel: envelope.channel, account: envelope.account, eventId: envelope.eventId }, turn),
             notifications: binding => this.deliveryStore.listOutbox({ bindingId: binding.id, limit: 50 }).filter(record => record.status === 'accepted'
-                && record.intent.metadata?.['dsh.native-notice'] === 'v1' && this.#notificationGuard(record) === undefined)
+                // Already-accepted notices stay listed: withdrawal only gates the send attempt.
+                && record.intent.metadata?.['dsh.native-notice'] === 'v1' && this.#notificationGuard(record, { withdrawal: false }) === undefined)
                 .map(record => ({ id: record.id, text: record.intent.text, createdAt: record.createdAt })),
         }, config);
         this.nativeWebOwner = access;
@@ -1991,11 +2116,17 @@ export class AssistantDeliveryService extends Service {
             capabilities: Object.freeze({ reconcileUnknownSend: true, receipts: [], formats: ['plain'] }),
             async start() { },
             send: async (intent) => {
-                if (this.#nativeNoticeGuard(intent) !== undefined)
-                    return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
+                // Pass the guard verdict through: a withdrawal-unavailable hold must stay retryable.
+                const refused = this.#nativeNoticeGuard(intent);
+                if (refused !== undefined)
+                    return refused;
                 return { outcome: 'accepted', providerMessageId: this.#notificationProviderId(intent) };
             },
-            reconcileUnknownSend: async (record) => { return record.intent.metadata?.['dsh.native-notice'] === 'v1' && this.#notificationGuard(record) === undefined ? { outcome: 'accepted', providerMessageId: this.#notificationProviderId(record.intent) } : { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false }; },
+            reconcileUnknownSend: async (record) => {
+                if (record.intent.metadata?.['dsh.native-notice'] !== 'v1')
+                    return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
+                return this.#notificationGuard(record) ?? { outcome: 'accepted', providerMessageId: this.#notificationProviderId(record.intent) };
+            },
         };
         ctx.effect(() => {
             const registration = this.registry.register(noticeAdapter);
@@ -2048,6 +2179,25 @@ export class AssistantDeliveryService extends Service {
         return Object.freeze({ protocol: 'assistant-delivery/foreground-tool-call/v1', task,
             turn: turn.turn, call });
     }
+    /** Read-only pages of this exact live owner's persisted human input. Callers
+     * cannot select an Inbox, path, owner, or replacement text through this API. */
+    readOwnerForegroundToolInput(input) {
+        if (!input || typeof input !== 'object' || Reflect.ownKeys(input).some(key => typeof key !== 'string'
+            || !['agent', 'authorityId', 'callId', 'toolName', 'argumentsJson', 'offset', 'maxBytes'].includes(key)))
+            return undefined;
+        const attestation = this.inspectOwnerForegroundToolCall(input);
+        if (attestation === undefined)
+            return undefined;
+        const page = this.deliveryStore.readPendingForegroundToolInput({ task: attestation.task,
+            ...(input.offset === undefined ? {} : { offset: input.offset }), ...(input.maxBytes === undefined ? {} : { maxBytes: input.maxBytes }) });
+        if (page === undefined)
+            return undefined;
+        const current = this.inspectOwnerForegroundToolCall(input);
+        if (current === undefined || acceptanceCanonicalJson(current) !== acceptanceCanonicalJson(attestation))
+            return undefined;
+        return Object.freeze({ protocol: 'assistant-delivery/foreground-tool-input/v1',
+            attestation, ...page });
+    }
     /** Host-only, read-only source proof for an owner's live memory or wiki tool call. */
     inspectOwnerRequestedChange(execution, input) {
         if (!this.active || !execution || typeof execution !== 'object'
@@ -2255,6 +2405,7 @@ export class AssistantDeliveryService extends Service {
         const token = Symbol('assistant-delivery.trusted-evaluation');
         this.evaluationSink = Object.freeze({ token, registration });
         void this.drainNaturalObjectiveIntents();
+        void this.drainWorkItemFeedback().catch(() => { });
         let active = true;
         return () => {
             if (!active)
@@ -2679,6 +2830,16 @@ export class AssistantDeliveryService extends Service {
         return inbox !== undefined && binding !== undefined && inbox.bindingId === binding.id
             && this.isInboundAuthorized(binding, inbox.envelope);
     }
+    /**
+     * Exact owner-configured peer bot, or `undefined`. `senderIsBot` is only the
+     * provider's declaration; the allowlisted tuple is the actual authority.
+     */
+    peerAgentAuthority(envelope) {
+        if (envelope.metadata?.senderIsBot !== 'true')
+            return undefined;
+        return this.config.peerAgents?.find(peer => peer.channel === envelope.channel && peer.account === envelope.account
+            && peer.tenant === envelope.principal.tenant && peer.user === envelope.principal.user);
+    }
     isInboundAuthorized(binding, envelope) {
         if (!this.active)
             return false;
@@ -3113,6 +3274,25 @@ export class AssistantDeliveryService extends Service {
         void this.drainWorkflowTraces();
         return 'recorded';
     }
+    /** Opt-in widened deterministic grammar; off keeps the legacy exact phrases. */
+    widenedNaturalFeedbackCoverage() {
+        return this.config.naturalFeedback?.coverage === true;
+    }
+    /** Splitting one reply into result + continuation requires both opt-ins. */
+    mixedNaturalFeedbackIntent() {
+        return this.config.naturalFeedback?.coverage === true
+            && this.config.naturalFeedback?.mixedIntent === true;
+    }
+    /**
+     * One canonical selection for admission and its later re-derivation fences.
+     * The widened parser is a pure function, so a frozen intent keeps verifying
+     * even after a restart that toggles the opt-in.
+     */
+    naturalObjectiveSelection(text) {
+        return this.widenedNaturalFeedbackCoverage()
+            ? parseNaturalOwnerReply(text)?.status
+            : parseNaturalObjectiveFeedback(text);
+    }
     /**
      * Convert only an authenticated reply to one exact Automation delivery into
      * a trusted objective label. The original run timestamp is retained because
@@ -3121,7 +3301,7 @@ export class AssistantDeliveryService extends Service {
      */
     async dispatchNaturalObjectiveFeedback(binding, envelope) {
         const selection = envelope.kind === 'text' && (envelope.attachments?.length ?? 0) === 0
-            ? parseNaturalObjectiveFeedback(envelope.text) : undefined;
+            ? this.naturalObjectiveSelection(envelope.text) : undefined;
         if (selection === undefined || !this.isOwnerFeedbackController(binding, envelope))
             return;
         const replyTarget = envelope.metadata?.replyToProviderMessageId;
@@ -3237,7 +3417,7 @@ export class AssistantDeliveryService extends Service {
         const naturalMatches = naturalIntent !== undefined && inbox.envelope.kind === 'text'
             && naturalIntent.envelopeHash === inbox.envelopeHash
             && naturalIntent.sourceOutboxId === target.id
-            && parseNaturalObjectiveFeedback(inbox.envelope.text) === naturalIntent.selection
+            && this.naturalObjectiveSelection(inbox.envelope.text) === naturalIntent.selection
             && (parsed.kind === 'objective-status' || (naturalIntent.status === 'frozen'
                 && JSON.stringify(naturalIntent.command) === JSON.stringify(parsed)));
         if ((inbox.envelope.attachments?.length ?? 0) !== 0 || (!typedMatches && !naturalMatches))
@@ -3665,7 +3845,7 @@ export class AssistantDeliveryService extends Service {
         const sessions = ctx.get('sessions');
         const agent = request.agent;
         const events = agent.session.snapshotEvents();
-        const reviewer = approvalReviewerOf(events);
+        const reviewer = approvalReviewerOf(events, agent.session.header.version);
         const reviewRoute = reviewer === 'user'
             ? 'user'
             : reviewer === 'auto-review' && ctx.assistantPolicy.isAutoReviewEscalation(request)
@@ -3804,7 +3984,8 @@ export class AssistantDeliveryService extends Service {
             return next();
         let reviewer;
         try {
-            reviewer = approvalReviewerOf(request.agent.session.snapshotEvents());
+            const session = request.agent.session;
+            reviewer = approvalReviewerOf(session.snapshotEvents(), session.header.version);
         }
         catch {
             return 'unavailable';
@@ -3983,6 +4164,32 @@ export class AssistantDeliveryService extends Service {
         if (!['received', 'authorized'].includes(record.status)) {
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         }
+        // An explicitly allowlisted peer bot enters its own linked-principal lane.
+        // It is still subject to the ordinary Policy ingest decision below and never
+        // receives owner feedback/continuation behavior. The allowlist is re-read
+        // for every provider-declared bot message: removing an entry revokes the
+        // lane even while the old linked principal row is still active.
+        const senderIsBot = envelope.metadata?.senderIsBot === 'true';
+        const peerAuthority = senderIsBot ? this.peerAgentAuthority(envelope) : undefined;
+        if (senderIsBot && peerAuthority === undefined) {
+            record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
+            return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+        }
+        if (peerAuthority !== undefined && !this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
+            const owner = this.deliveryStore.activeOwnerPrincipal();
+            if (owner === undefined) {
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-owner-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+            try {
+                this.deliveryStore.ensurePeerPrincipal(envelope.principal, owner.id, { reauthorize: true });
+            }
+            catch (error) {
+                this.context.logger.warn(`assistant-delivery: peer principal admission failed: ${String(error)}`);
+                record = this.deliveryStore.deadLetterInbox(record.id, 'peer-principal-unavailable');
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
+            }
+        }
         if (!this.deliveryStore.isAuthorizedPrincipal(envelope.principal)) {
             record = this.deliveryStore.deadLetterInbox(record.id, 'unauthorized-principal');
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
@@ -4024,6 +4231,7 @@ export class AssistantDeliveryService extends Service {
                     beforeInboxId: record.id,
                     failureCode: 'new-session-before-dispatch',
                 });
+                this.notifyWorkItemReplyCancellation(fence.replyChildItemIds ?? []);
                 this.restartStore?.cancelForBinding(binding.id);
                 await this.runtime?.cancelActive?.(binding, 'new');
                 await this.inbound.cancelUndispatchedClaims(fence.claimedInboxIds, 'new');
@@ -4059,6 +4267,7 @@ export class AssistantDeliveryService extends Service {
                 });
                 // Holding the transition while the live turn drains prevents a later
                 // message from overtaking the durable stop acknowledgement.
+                this.notifyWorkItemReplyCancellation(fence.replyChildItemIds ?? []);
                 this.restartStore?.cancelForBinding(binding.id);
                 await this.runtime?.cancelActive?.(binding, 'stop');
                 await this.inbound.cancelUndispatchedClaims(fence.claimedInboxIds, 'stop');
@@ -4085,132 +4294,1145 @@ export class AssistantDeliveryService extends Service {
                 const failed = this.deliveryStore.getInbox(record.id);
                 return { duplicate: accepted.duplicate, inboxId: failed.id, status: failed.status };
             }
+            // Slice 5: a reply to the exact delivered owner-question notice is
+            // consumed here, before any Agent admission. Applied replies are
+            // processed; a transient consumer failure leaves the Inbox pending.
+            const attentionReply = this.inspectOwnerQuestionReply(record, binding);
+            if (attentionReply !== 'none') {
+                const current = this.deliveryStore.getInbox(record.id);
+                return { duplicate: accepted.duplicate, inboxId: current.id, status: current.status };
+            }
+            const feedback = this.inspectOwnerWorkItemFeedback(record, binding);
+            const splitContinuation = feedback.kind !== 'none' && feedback.continuation;
+            if (feedback.kind === 'ready') {
+                // One reply may carry a result and an explicit continuation. They are two
+                // independently fenced decisions: admit both atomically when both lanes
+                // are permitted, otherwise record the result alone and record the reason.
+                let admittedContinuation = false;
+                if (splitContinuation) {
+                    const report = this.prepareWorkItemReply(record, binding);
+                    if (report !== undefined) {
+                        try {
+                            this.deliveryStore.admitOwnerWorkItemFeedbackWithReply({ feedback: feedback.source, binding, report, fence: feedback.fence });
+                            admittedContinuation = true;
+                        }
+                        catch (error) {
+                            // The combined transaction rolled back; fall back to the result lane
+                            // only. A failed result fence re-throws on that fallback, as before.
+                            this.context.logger.warn(`assistant-delivery: mixed owner feedback continuation admission failed: ${String(error)}`);
+                        }
+                    }
+                }
+                if (!admittedContinuation) {
+                    this.deliveryStore.workItemFeedback.admit(feedback.source, feedback.fence);
+                    if (splitContinuation)
+                        this.recordPartialMixedFeedbackAdmission(record, 'continuation-not-admitted');
+                }
+                if (admittedContinuation)
+                    this.notifyWorkItemReplyPending();
+                void this.drainWorkItemFeedback().catch(() => { });
+                return { duplicate: accepted.duplicate, inboxId: record.id, status: 'processed' };
+            }
+            // A pure recognized result never becomes execution when feedback permission
+            // is absent; only an explicit continuation in the same reply may proceed.
+            const continuationAllowed = feedback.kind === 'none'
+                || (feedback.kind === 'ordinary' && splitContinuation);
+            if (continuationAllowed && this.admitWorkItemReply(record, binding)) {
+                const handedOff = this.deliveryStore.getInbox(record.id);
+                this.notifyWorkItemReplyPending();
+                if (feedback.kind === 'ordinary')
+                    this.recordPartialMixedFeedbackAdmission(record, 'feedback-not-admitted');
+                return { duplicate: accepted.duplicate, inboxId: handedOff.id, status: handedOff.status };
+            }
+            if (feedback.kind === 'ordinary' && splitContinuation)
+                this.recordPartialMixedFeedbackAdmission(record, 'neither-lane-admitted');
             record = this.deliveryStore.queueInbox(record.id, binding.id);
             return { duplicate: accepted.duplicate, inboxId: record.id, status: record.status };
         });
     }
-    enqueueBackground(input) {
-        this.assertActive();
-        if (containsReservedLearningMetadata(input.metadata) || Object.keys(input.metadata ?? {}).some(key => key.startsWith('dsh.native-notice'))) {
-            throw new AssistantDeliveryError('runtime-conflict', 'reserved metadata requires its typed delivery interface');
+    /**
+     * Deterministic backend classification of one authenticated owner reply to an
+     * exact report. The legacy closed whole-sentence grammar stays in force unless
+     * the widened coverage opt-in is on; no caller text is reinterpreted as an
+     * instruction, and no model is called.
+     */
+    parseWorkItemFeedback(envelope) {
+        if ((envelope.attachments?.length ?? 0) !== 0)
+            return undefined;
+        if (envelope.kind === 'text') {
+            const text = envelope.text.trim();
+            if (!this.widenedNaturalFeedbackCoverage()) {
+                if (!/^(?:问题解决了|已经解决了|现在解决了|还是不行|还没解决|问题还没解决|撤回刚才的任务反馈|撤回我刚才的任务反馈)[。.!！]?$/u.test(text))
+                    return undefined;
+                const value = parseNaturalObjectiveFeedback(text);
+                return value === undefined ? undefined : { selection: { kind: 'natural', value }, continuation: false };
+            }
+            const parsed = parseNaturalOwnerReply(text);
+            return parsed === undefined ? undefined : {
+                selection: { kind: 'natural', value: parsed.status },
+                continuation: parsed.continuation && this.mixedNaturalFeedbackIntent(),
+            };
         }
-        return this.enqueueBackgroundAuthorized(input);
+        const command = parseDeliveryCommand(envelope);
+        if (command?.name !== 'feedback')
+            return undefined;
+        const parsed = parseFeedbackCommand(command.rawInput);
+        return ['objective', 'objective-status', 'objective-revision'].includes(parsed.kind)
+            ? { selection: { kind: 'explicit', command: parsed }, continuation: false }
+            : undefined;
     }
-    enqueueBackgroundAuthorized(input) {
-        const binding = this.deliveryStore.getBinding(input.bindingId);
-        if (binding === undefined || binding.status !== 'active' || !this.hasActivePrincipal(binding)) {
-            throw new AssistantDeliveryError('missing-binding', 'delivery binding does not exist or is revoked');
-        }
-        if (binding.workspace !== input.workspace) {
-            throw new AssistantDeliveryError('missing-binding', 'delivery workspace does not match the active binding');
-        }
-        const decision = this.policy.authorize({ subject: { kind: 'background', id: input.sourceId,
-                workspace: input.workspace, principal: externalPrincipalId(binding.principal) }, action: 'send',
-            resource: { kind: 'message', id: binding.id }, context: { initiator: 'background' } }, { idempotencyKey: `message-send:${input.idempotencyKey}` });
-        if (decision.effect !== 'allow')
-            throw policyDenied(decision);
-        if (!this.hasActivePrincipal(binding)) {
-            throw new AssistantDeliveryError('missing-binding', 'delivery binding principal is no longer active');
+    workItemFeedbackPermission(binding, registration) {
+        return this.policy.evaluate({ subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+            action: 'feedback-work-items', resource: { kind: 'automation', id: registration.continuationAutomationId }, context: { initiator: 'external' } }).effect === 'allow';
+    }
+    /**
+     * Inspect one Inbox as an authenticated owner result reply to an exact report.
+     * `ready` carries the frozen source plus its live admission fence; `ordinary`
+     * keeps the historical "recognized result but separate feedback permission
+     * absent" outcome and never admits the result lane by itself. The
+     * `continuation` flag is a deterministic classification only.
+     */
+    inspectOwnerWorkItemFeedback(inbox, binding) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const parsed = this.parseWorkItemFeedback(inbox.envelope);
+        if (!registration || registration.feedbackEnabled !== true || parsed === undefined || !inbox.envelope.metadata?.replyToProviderMessageId)
+            return { kind: 'none' };
+        const report = this.deliveryStore.workItemReplies.replyReport(inbox.channel, inbox.account, inbox.envelope.metadata.replyToProviderMessageId);
+        if (!report || !['accepted', 'delivered', 'read'].includes(report.outbox.status) || !report.outbox.providerMessageId
+            || workItemReplyCanonical(report.outbox.intent.target.conversation) !== workItemReplyCanonical(inbox.envelope.conversation)
+            || workItemReplyCanonical(report.outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal))
+            return { kind: 'none' };
+        let target;
+        try {
+            target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId, reportRevision: report.target.reportRevision,
+                bindingId: report.outbox.intent.bindingId, idempotencyKey: report.outbox.intent.idempotencyKey, text: report.outbox.intent.text,
+                format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
         }
-        return this.deliveryStore.enqueue({ idempotencyKey: input.idempotencyKey, bindingId: binding.id,
-            target: { conversation: binding.conversation, principal: binding.principal }, text: input.text,
-            format: input.format ?? 'plain',
-            ...(input.metadata === undefined ? {} : { metadata: input.metadata }) });
+        catch {
+            return { kind: 'none' };
+        }
+        if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
+            return { kind: 'none' };
+        const continuation = parsed.continuation;
+        // A recognized result must not be converted into execution when its separate feedback permission is absent.
+        if (!this.workItemFeedbackPermission(binding, registration))
+            return { kind: 'ordinary', continuation };
+        const source = { protocol: 'assistant-delivery/work-item-feedback/v1', inboxId: inbox.id, envelopeHash: inbox.envelopeHash,
+            inputText: inbox.envelope.text, inputSha256: createHash('sha256').update(inbox.envelope.text).digest('hex'), admissionCursor: inbox.admissionCursor, occurredAt: inbox.receivedAt,
+            owner: target.owner, principalId: externalPrincipalId(binding.principal), binding: { id: binding.id, version: binding.version, generation: binding.generation }, scope: target.scope,
+            target: { outboxId: report.outbox.id, providerMessageId: report.outbox.providerMessageId, itemId: target.itemId, reportRevision: target.reportRevision, reportDigest: target.reportDigest, streamId: target.streamId }, selection: parsed.selection,
+            operationId: `owner-work-item-feedback:${createHash('sha256').update(JSON.stringify([inbox.id, inbox.envelopeHash])).digest('hex')}` };
+        const fence = () => {
+            const current = this.currentWorkItemReplyConsumer(), owner = this.ownerLineageForBinding(binding), active = this.deliveryStore.getBinding(binding.id);
+            if (current !== registration || current?.feedbackEnabled !== true || workItemReplyCanonical(owner) !== workItemReplyCanonical(source.owner)
+                || workItemReplyCanonical(active) !== workItemReplyCanonical(binding) || !this.workItemFeedbackPermission(binding, registration))
+                throw new Error('feedback admission authority changed');
+        };
+        return { kind: 'ready', source, fence, continuation };
+    }
+    /** One deterministic, non-durable record when a mixed reply could only admit one lane. */
+    recordPartialMixedFeedbackAdmission(inbox, reason) {
+        this.context.logger.warn(`assistant-delivery: mixed owner feedback ${inbox.id} admitted partially (${reason})`);
+    }
+    /** Passing an explicit registration makes this the callback-free final local authority check. */
+    workItemFeedbackFence(intent, recorded = false, expectedRegistration) {
+        const registration = expectedRegistration ?? this.currentWorkItemReplyConsumer(), source = intent.source;
+        const current = this.deliveryStore.workItemFeedback.get(source.inboxId);
+        const inbox = this.deliveryStore.getInbox(source.inboxId), original = this.deliveryStore.getBinding(source.binding.id);
+        const binding = recorded && original ? this.deliveryStore.getActiveBinding(original.conversation) : original;
+        if (!this.active || !registration || this.workItemReplyConsumer !== registration || registration.feedbackEnabled !== true || !current || current.state === 'cancelled' || (current.state === 'conflict' && !recorded)
+            || current.state !== intent.state || current.sourceDigest !== intent.sourceDigest || !inbox || inbox.status !== 'processed' || inbox.bindingId !== source.binding.id
+            || inbox.envelopeHash !== source.envelopeHash || inbox.envelope.text !== source.inputText || !binding || binding.status !== 'active'
+            || (!recorded && (binding.id !== source.binding.id || binding.version !== source.binding.version || binding.generation !== source.binding.generation))
+            || workItemReplyCanonical(this.ownerLineageForBinding(binding)) !== workItemReplyCanonical(source.owner)
+            || binding.workspace !== source.scope.workspace || binding.agentPreset !== source.scope.preset
+            || !this.workItemFeedbackPermission(binding, registration))
+            throw new Error('work item feedback authority changed');
+        return registration;
+    }
+    workItemFeedbackProof(intent, recorded = false) {
+        const registration = this.workItemFeedbackFence(intent, recorded), source = intent.source;
+        const report = this.deliveryStore.workItemReplies.replyReport(this.deliveryStore.getInbox(source.inboxId).channel, this.deliveryStore.getInbox(source.inboxId).account, source.target.providerMessageId);
+        if (!report || report.outbox.id !== source.target.outboxId || !['accepted', 'delivered', 'read'].includes(report.outbox.status))
+            throw new Error('work item feedback report changed');
+        const target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: source.target.itemId, reportRevision: source.target.reportRevision,
+            bindingId: report.outbox.intent.bindingId, idempotencyKey: report.outbox.intent.idempotencyKey, text: report.outbox.intent.text, format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
+        if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
+            throw new Error('work item feedback target changed');
+        this.workItemFeedbackFence(intent, recorded);
+        const peer = this.context.get('assistantWorkItems', false);
+        if (!peer?.issueOwnerWorkItemFeedbackTarget || !peer.resolveOwnerWorkItemFeedbackTarget)
+            return undefined;
+        const capability = peer.issueOwnerWorkItemFeedbackTarget({ itemId: source.target.itemId, reportRevision: source.target.reportRevision, reportDigest: source.target.reportDigest });
+        this.workItemFeedbackFence(intent, recorded);
+        if (capability === undefined)
+            return undefined;
+        const proof = peer.resolveOwnerWorkItemFeedbackTarget(capability);
+        if (workItemPeerIdentity(this.context.get('assistantWorkItems', false)) !== workItemPeerIdentity(peer) || this.workItemFeedbackFence(intent, recorded, registration) !== registration)
+            return undefined;
+        if (!proof)
+            return undefined;
+        if (proof.protocol !== 'assistant-work-items/owner-report-feedback/v1' || proof.itemId !== source.target.itemId || proof.reportRevision !== source.target.reportRevision
+            || proof.reportDigest !== source.target.reportDigest || proof.sourceId !== registration.sourceId || proof.scope.workspace !== source.scope.workspace || proof.scope.preset !== source.scope.preset
+            || proof.owner.principalRecordId !== source.owner.principalRecordId || proof.owner.principalVersion !== source.owner.principalVersion || proof.owner.principalId !== source.principalId
+            || proof.originBindingId !== report.binding.id || proof.production.quiescent !== true || proof.production.budgetSettlementState !== 'finalized'
+            || !/^[a-f0-9]{64}$/u.test(proof.proofDigest))
+            throw new Error('work item feedback proof mismatch');
+        const { proofDigest: observedDigest, ...unsignedProof } = proof;
+        if (workItemReplyDigest(unsignedProof) !== observedDigest)
+            throw new Error('noncanonical work item feedback proof');
+        if (intent.proofDigest !== undefined && intent.proofDigest !== proof.proofDigest)
+            throw new Error('frozen work item feedback proof changed');
+        return { capability, proof, registration, peerIdentity: workItemPeerIdentity(peer) };
+    }
+    drainWorkItemFeedback() {
+        if (this.workItemFeedbackFlight)
+            return this.workItemFeedbackFlight;
+        const flight = this.runWorkItemFeedback().finally(() => { if (this.workItemFeedbackFlight === flight)
+            this.workItemFeedbackFlight = undefined; });
+        this.workItemFeedbackFlight = flight;
+        return flight;
     }
-    #notificationGuard(record) {
-        const key = record.intent.idempotencyKey;
-        if (key.startsWith('inbound:') && (key.endsWith(':maintenance') || key.endsWith(':maintenance-failed'))) {
+    async runWorkItemFeedback() {
+        if (!this.active || this.currentWorkItemReplyConsumer()?.feedbackEnabled !== true)
+            return;
+        this.drainWorkItemFeedbackAcks();
+        if (!this.evaluationSink)
+            return;
+        const page = this.deliveryStore.workItemFeedback.pending(this.workItemFeedbackCursor, 100);
+        this.workItemFeedbackCursor = page.length === 100 ? page.at(-1).source.admissionCursor.sequence : 0;
+        for (let intent of page) {
+            if (!this.active)
+                return;
             try {
-                const failed = key.endsWith(':maintenance-failed');
-                const inboxId = key.slice('inbound:'.length, -(failed ? ':maintenance-failed'.length : ':maintenance'.length));
-                const request = this.restartStore?.getRequestForTask(inboxId);
-                const task = this.restartStore?.getTask(inboxId);
-                const inbox = this.deliveryStore.getInbox(inboxId);
-                const binding = this.deliveryStore.getBinding(record.intent.bindingId);
-                if (request === undefined || task === undefined || inbox === undefined || binding === undefined
-                    || request.status === 'cancelled' || (failed ? request.status !== 'failed' : !this.restartAuthorized(request))
-                    || task.binding.id !== binding.id || task.binding.version !== binding.version || task.binding.generation !== binding.generation
-                    || task.owner.principalRecordId !== this.ownerLineageForBinding(binding)?.principalRecordId
-                    || task.owner.principalVersion !== this.ownerLineageForBinding(binding)?.principalVersion
-                    || inbox.bindingId !== binding.id || inbox.eventId !== record.intent.replyToEventId
-                    || !this.isInboundAuthorized(binding, inbox.envelope)
-                    || this.deliveryStore.getOutboxByIdempotencyKey(`inbound:${inbox.id}:reply`) !== undefined
-                    || this.deliveryStore.getOutboxByIdempotencyKey(`inbound:${inbox.eventId}:reply`) !== undefined)
-                    throw new Error('maintenance notice is stale');
-                const decision = this.policy.evaluate({ subject: { kind: 'agent', id: binding.agentPreset,
-                        workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
-                    action: 'reply', resource: { kind: 'message', id: binding.id }, context: { initiator: 'external' } });
-                if (decision.effect !== 'allow')
-                    throw new Error('maintenance notice permission changed');
+                const resolved = this.workItemFeedbackProof(intent);
+                if (!resolved)
+                    continue;
+                const { proof, capability } = resolved;
+                const sink = this.evaluationSink;
+                if (!sink || sink.registration.ownerRevisionProtocol !== 'owner-objective-revision/v2' || !sink.registration.inspect)
+                    continue;
+                const source = intent.source, initialKey = `work-item-owner-initial:${workItemReplyDigest([source.scope, source.target.itemId, source.owner])}`;
+                const claimsFor = (command) => ({ scope: source.scope, situation: `work-item:${proof.itemKind}`,
+                    subjectKind: 'work-item', subjectRef: source.target.itemId, runId: proof.production.runId, outboxId: source.target.outboxId, chatId: this.deliveryStore.getInbox(source.inboxId).envelope.conversation.chat,
+                    principalId: source.principalId, bindingId: source.binding.id, workItemOutcomeCapability: capability,
+                    objectiveStatus: command.kind === 'objective-status' ? 'achieved' : command.objectiveStatus,
+                    ownerCommand: { ...source.owner, operationId: source.operationId, action: command.kind === 'objective-revision' ? command.action : 'initial', ...(command.kind === 'objective-revision' ? { expectedVersion: command.expectedVersion, previousStatus: command.previousStatus } : {}) },
+                    occurredAt: source.occurredAt, initialIdempotencyKey: initialKey, idempotencyKey: command.kind === 'objective-revision' ? source.operationId : initialKey });
+                const inspectClaims = claimsFor({ kind: 'objective-status' }), inspectCapability = sink.registration.issueCapability(inspectClaims);
+                if (this.evaluationSink?.token !== sink.token)
+                    continue;
+                this.workItemFeedbackFence(intent);
+                const current = sink.registration.inspect(inspectCapability);
+                this.workItemFeedbackFence(intent);
+                if (this.evaluationSink?.token !== sink.token)
+                    continue;
+                const evaluation = this.context.get('assistantEvaluation', false);
+                const projection = evaluation?.getTrustedWorkItemLearningProjection({ scope: evaluation.canonicalHostScope(source.scope), itemId: source.target.itemId });
+                this.workItemFeedbackFence(intent);
+                if (intent.state === 'pending') {
+                    const selection = source.selection;
+                    let command;
+                    if (selection.kind === 'explicit')
+                        command = selection.command;
+                    else if (selection.value === 'withdraw' && (!current || current.objectiveStatus === 'unknown')) {
+                        this.deliveryStore.workItemFeedback.settle(source.inboxId, 'conflict', undefined, () => { this.workItemFeedbackFence(intent); });
+                        continue;
+                    }
+                    else if (current && selection.value === current.objectiveStatus)
+                        command = { kind: 'objective-status' };
+                    else
+                        command = current ? { kind: 'objective-revision', action: selection.value === 'withdraw' ? 'withdraw' : 'correct', expectedVersion: current.version, previousStatus: current.objectiveStatus, objectiveStatus: selection.value === 'withdraw' ? 'unknown' : selection.value }
+                            : { kind: 'objective', objectiveStatus: selection.value };
+                    intent = this.deliveryStore.workItemFeedback.freeze(source.inboxId, command, proof.proofDigest, () => { this.workItemFeedbackFence(intent); });
+                }
+                if (intent.state !== 'frozen' || !intent.command)
+                    continue;
+                const command = intent.command;
+                if (command.kind === 'objective-status') {
+                    this.deliveryStore.workItemFeedback.settle(source.inboxId, 'recorded', { version: current?.version ?? 0, objectiveStatus: current?.objectiveStatus ?? 'unknown', ...(projection?.objective?.outcomeId ? { outcomeId: projection.objective.outcomeId } : {}) }, () => { this.workItemFeedbackFence(intent); });
+                    continue;
+                }
+                const claims = claimsFor(command), receipt = sink.registration.issueCapability(claims);
+                this.workItemFeedbackFence(intent);
+                if (this.evaluationSink?.token !== sink.token)
+                    continue;
+                const outcome = sink.registration.append({ capabilityReceipt: receipt, runId: claims.runId, outboxId: claims.outboxId, chatId: claims.chatId, principalId: claims.principalId, bindingId: claims.bindingId, idempotencyKey: claims.idempotencyKey });
+                const settled = this.deliveryStore.workItemFeedback.get(source.inboxId);
+                if (this.evaluationSink?.token !== sink.token || !outcome.ownerFeedbackState || settled?.state !== 'recorded'
+                    || settled.canonical?.outcomeId !== outcome.id)
+                    continue;
+                this.workItemFeedbackFence(settled);
             }
-            catch {
-                return { outcome: 'not-sent', failureCode: 'maintenance-notice-stale', retryable: false };
+            catch (error) {
+                if (typeof error === 'object' && error !== null && 'code' in error && ['version-conflict', 'idempotency-conflict'].includes(String(error.code))) {
+                    this.deliveryStore.workItemFeedback.settle(intent.source.inboxId, 'conflict', undefined, () => { this.workItemFeedbackFence(intent); });
+                }
+                // Dependency absence and unknown append outcomes remain durable; no foreground or worker replay.
             }
-            return undefined;
         }
-        if (key.startsWith('inbound:') && key.endsWith(':interrupted')) {
+        if (this.active)
+            this.drainWorkItemFeedbackAcks();
+    }
+    drainWorkItemFeedbackAcks() {
+        const page = this.deliveryStore.workItemFeedback.pendingAcknowledgements(this.workItemFeedbackAckCursor, 100);
+        this.workItemFeedbackAckCursor = page.length === 100 ? page.at(-1).source.admissionCursor.sequence : 0;
+        for (const intent of page) {
             try {
-                const inboxId = key.slice('inbound:'.length, -':interrupted'.length);
-                const inbox = this.deliveryStore.getInbox(inboxId);
-                const binding = this.deliveryStore.getBinding(record.intent.bindingId);
-                const expectedNotice = inbox?.failureCode === 'agent-task-timeout'
-                    ? timedOutTurnNotice : interruptedTurnNotice;
-                if (record.intent.text !== expectedNotice || inbox === undefined || binding === undefined
-                    || !this.deliveryStore.canSendInterruptedInboxNotice(record)
-                    || !this.isInboundAuthorized(binding, inbox.envelope)) {
-                    throw new Error('interrupted Inbox authority changed');
-                }
-                const reply = this.policy.evaluate({
-                    subject: { kind: 'agent', id: binding.agentPreset, workspace: binding.workspace,
-                        principal: externalPrincipalId(binding.principal) },
-                    action: 'reply', resource: { kind: 'message', id: binding.id },
-                    context: { initiator: 'external' },
-                });
-                if (reply.effect !== 'allow')
-                    throw new Error('interrupted Inbox reply authority changed');
-            }
-            catch {
-                return { outcome: 'not-sent', failureCode: 'interrupted-inbox-authority-revoked', retryable: false };
+                const registration = this.workItemFeedbackFence(intent, true);
+                const original = this.deliveryStore.getBinding(intent.source.binding.id), binding = this.deliveryStore.getActiveBinding(original.conversation);
+                const text = intent.state === 'conflict' ? '任务反馈版本已变化，本次更改未生效。请回复原报告发送 /feedback status 查看当前版本。'
+                    : intent.canonical?.version === 0 ? '查询时该工作项暂无已记录反馈。' : objectiveStateMessage(intent.canonical).replace('当前任务反馈：', intent.command?.kind === 'objective-status' ? '查询时的任务反馈：' : '本次已记录任务反馈：');
+                this.enqueueBackgroundAuthorized({ sourceId: registration.sourceId, workspace: binding.workspace, bindingId: binding.id,
+                    idempotencyKey: `feedback:${intent.source.inboxId}:ack`, text, format: 'plain' }, undefined, 
+                // Host-authored result ACK: the Host always declares its purpose through the lane (WP19).
+                { lane: 'background', lanePurpose: { purpose: 'result' } });
             }
+            catch { /* Recording is independent of send authority; only an absent Outbox is retried. */ }
+        }
+    }
+    withOwnerWorkItemFeedbackWriterFence(registration, claims, proofDigest, callback) {
+        this.assertActive();
+        const sink = this.evaluationSink;
+        if (!sink || sink.registration !== registration || !registrationOwnedByEvaluation(registration)
+            || claims.subjectKind !== 'work-item' || !claims.ownerCommand)
+            throw new Error('work item owner writer registration is not current');
+        const consumer = this.currentWorkItemReplyConsumer();
+        const peer = this.context.get('assistantWorkItems', false);
+        const peerIdentity = workItemPeerIdentity(peer);
+        if (!consumer || consumer.feedbackEnabled !== true || typeof peer?.resolveOwnerWorkItemFeedbackTarget !== 'function')
+            throw new Error('work item feedback producer is not current');
+        return this.deliveryStore.workItemFeedback.withOwnerWriterFence(claims.ownerCommand.operationId, intent => {
+            const source = intent.source, command = intent.command;
+            const initialKey = `work-item-owner-initial:${workItemReplyDigest([source.scope, source.target.itemId, source.owner])}`;
+            if (claims.initialIdempotencyKey !== initialKey || claims.idempotencyKey !== (command?.kind === 'objective-revision' ? source.operationId : initialKey))
+                throw new Error('owner feedback operation identity changed');
+            if (!command || command.kind === 'objective-status' || intent.proofDigest !== proofDigest || source.operationId !== claims.ownerCommand.operationId
+                || workItemReplyCanonical(source.scope) !== workItemReplyCanonical(claims.scope) || source.target.itemId !== claims.subjectRef
+                || source.target.outboxId !== claims.outboxId || source.binding.id !== claims.bindingId || source.principalId !== claims.principalId
+                || claims.chatId !== this.deliveryStore.getInbox(source.inboxId).envelope.conversation.chat || claims.occurredAt !== source.occurredAt
+                || claims.objectiveStatus !== command.objectiveStatus
+                || workItemReplyCanonical(claims.ownerCommand) !== workItemReplyCanonical({ ...source.owner, operationId: source.operationId,
+                    action: command.kind === 'objective-revision' ? command.action : 'initial', ...(command.kind === 'objective-revision' ? { expectedVersion: command.expectedVersion, previousStatus: command.previousStatus } : {}) }))
+                throw new Error('frozen work item feedback claims changed');
+            // Complete every ownership callback before one final bounded production
+            // resolve. No producer callback runs between that proof and the write.
+            if (this.currentWorkItemReplyConsumer() !== consumer || this.evaluationSink?.token !== sink.token)
+                throw new Error('feedback writer generation changed');
+            const finalProof = peer.resolveOwnerWorkItemFeedbackTarget(claims.workItemOutcomeCapability);
+            if (!finalProof || finalProof.proofDigest !== proofDigest || workItemPeerIdentity(this.context.get('assistantWorkItems', false)) !== peerIdentity
+                || this.evaluationSink?.token !== sink.token)
+                throw new Error('production proof changed after writer ownership callbacks');
+            const { proofDigest: finalDigest, ...finalUnsigned } = finalProof;
+            if (workItemReplyDigest(finalUnsigned) !== finalDigest)
+                throw new Error('final production proof digest changed');
+            this.workItemFeedbackFence(intent, false, consumer);
+            return callback();
+        }, (intent, result) => {
+            const value = result;
+            const command = intent.command;
+            if (!value || typeof value !== 'object' || !value.id || !value.ownerFeedbackState || command.kind === 'objective-status'
+                || value.ownerFeedbackState.objectiveStatus !== claims.objectiveStatus
+                || value.ownerFeedbackState.version !== (command.kind === 'objective-revision' ? command.expectedVersion + 1 : 1)
+                || value.objectiveStatus !== claims.objectiveStatus || value.idempotencyKey !== claims.idempotencyKey
+                || workItemReplyCanonical(value.scope) !== workItemReplyCanonical(claims.scope)
+                || value.source?.kind !== 'user-feedback' || value.source.id !== 'assistant-delivery/typed-owner-feedback'
+                || !value.evidence?.some(ref => ref.kind === 'work-item-owner-result' && ref.ref === intent.source.target.itemId)
+                || !value.evidence?.some(ref => ref.kind === 'work-item-production-proof' && ref.ref === claims.runId && ref.digest === proofDigest))
+                throw new Error('canonical work item feedback result changed');
+            if (this.evaluationSink?.token !== sink.token)
+                throw new Error('feedback writer registration changed before ACK');
+            this.workItemFeedbackFence(intent, false, consumer);
+            return { ...value.ownerFeedbackState, outcomeId: value.id };
+        });
+    }
+    workItemReplyProtocolVersion() { return 1; }
+    currentWorkItemReplyConsumer() {
+        const registration = this.workItemReplyConsumer;
+        const peer = this.context.get('assistantWorkItems', false);
+        return this.active && registration !== undefined && peer?.ownsWorkItemReplyRegistration?.(registration) === true ? registration : undefined;
+    }
+    registerWorkItemReplyConsumer(registration) {
+        this.assertActive();
+        if (!registration || registration.protocol !== 1 || typeof registration.sourceId !== 'string' || !registration.sourceId
+            || typeof registration.continuationAutomationId !== 'string' || !registration.continuationAutomationId
+            || ['inspectReport', 'inspectChild', 'onPending', 'onCancelled'].some(key => typeof registration[key] !== 'function')) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid work item reply consumer');
+        }
+        if (this.workItemReplyConsumer !== undefined)
+            throw new AssistantDeliveryError('runtime-conflict', 'work item reply consumer already registered');
+        this.workItemReplyConsumer = registration;
+        if (this.currentWorkItemReplyConsumer() !== registration) {
+            this.workItemReplyConsumer = undefined;
+            throw new AssistantDeliveryError('runtime-conflict', 'work item reply consumer lacks current producer ownership');
+        }
+        let live = true;
+        // Registered callbacks run synchronously and only receive committed state.
+        // The consumer schedules its own bounded drain; Delivery owns no extra loop.
+        this.notifyWorkItemReplyPending();
+        void this.drainWorkItemFeedback().catch(() => { });
+        return () => { if (live) {
+            live = false;
+            if (this.workItemReplyConsumer === registration)
+                this.workItemReplyConsumer = undefined;
+        } };
+    }
+    /**
+     * WP20 intake: one observer, owned by the current WorkItems service, receives
+     * a metadata-only signal per adapter observation. Delivery adds only the
+     * read-only allowlist and tracked-report-thread facts; it writes nothing.
+     */
+    registerInboundIntakeObserver(observer) {
+        this.assertActive();
+        if (!observer || observer.protocol !== 1 || typeof observer.observe !== 'function')
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid inbound intake observer');
+        if (this.inboundIntakeObserver !== undefined)
+            throw new AssistantDeliveryError('runtime-conflict', 'inbound intake observer already registered');
+        this.inboundIntakeObserver = observer;
+        if (this.currentInboundIntakeObserver() !== observer) {
+            this.inboundIntakeObserver = undefined;
+            throw new AssistantDeliveryError('runtime-conflict', 'inbound intake observer lacks current WorkItems ownership');
+        }
+        let live = true;
+        return () => { if (live) {
+            live = false;
+            if (this.inboundIntakeObserver === observer)
+                this.inboundIntakeObserver = undefined;
+        } };
+    }
+    currentInboundIntakeObserver() {
+        const observer = this.inboundIntakeObserver;
+        if (!this.active || observer === undefined)
+            return undefined;
+        const peer = this.context.get('assistantWorkItems', false);
+        return peer?.ownsInboundIntakeObserver?.(observer) === true ? observer : undefined;
+    }
+    /** Best-effort and side-effect free: any invalid input or observer failure is dropped. */
+    observeInbound(observation) {
+        try {
+            const observer = this.currentInboundIntakeObserver();
+            if (observer === undefined)
+                return;
+            const signal = this.inboundIntakeSignal(observation, observer.acceptsSourceText === true);
+            if (signal !== undefined)
+                observer.observe(signal);
+        }
+        catch (error) {
+            this.context.logger.debug(`assistant-delivery: inbound intake observation dropped: ${String(error)}`);
+        }
+    }
+    inboundIntakeSignal(input, withText = false) {
+        const principal = input?.principal, conversation = input?.conversation;
+        const text = (value) => typeof value === 'string' && value.length > 0 && value.length <= 256;
+        if (!principal || !conversation || !text(input.eventId) || !text(principal.channel) || !text(principal.account)
+            || !text(principal.tenant) || !text(principal.user) || !text(conversation.chat)
+            || (conversation.kind !== 'dm' && conversation.kind !== 'group')
+            || typeof input.addressed !== 'boolean' || typeof input.senderIsBot !== 'boolean'
+            || !Number.isSafeInteger(input.occurredAt) || input.occurredAt < 0
+            || (input.replyToProviderMessageId !== undefined && !text(input.replyToProviderMessageId))
+            || (input.contentDigest !== undefined && !/^[0-9a-f]{64}$/u.test(input.contentDigest))
+            || !/^[a-z][a-z0-9-]{0,54}$/u.test(principal.channel))
             return undefined;
+        const key = { channel: principal.channel, account: principal.account, tenant: principal.tenant, user: principal.user };
+        // Only the owner role is a trusted intake sender. A linked peer bot is
+        // authorized to converse, but its messages must stay `inferred`/filtered
+        // rather than entering the owner work-item allowlist.
+        const principalRecord = this.deliveryStore.getPrincipal(key);
+        const senderAllowlisted = principalRecord?.status === 'active' && principalRecord.role === 'owner';
+        // A follow-up counts only from an allowlisted sender replying, in the same
+        // conversation, to a delivered WorkItems report.
+        let threadFollowUp = false;
+        if (senderAllowlisted && input.replyToProviderMessageId !== undefined) {
+            const report = this.deliveryStore.workItemReplies.replyReport(key.channel, key.account, input.replyToProviderMessageId);
+            const target = report?.outbox.intent.target.conversation;
+            threadFollowUp = report !== undefined && ['accepted', 'delivered', 'read'].includes(report.outbox.status)
+                && target?.kind === conversation.kind && target.chat === conversation.chat;
         }
-        const metadata = record.intent.metadata;
-        const nativeKeys = Object.keys(metadata ?? {}).filter(key => key.startsWith('dsh.native-notice'));
-        if (nativeKeys.length > 0) {
-            // Native adapter sends receive only an intent, so never bind a fabricated
-            // outbox id into the goal-outcome sidecar lookup. A persisted record still
-            // rejects any sidecar collision before native authority is considered.
-            if (containsReservedLearningMetadata(metadata))
-                return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
-            if (typeof record.id === 'string') {
-                try {
-                    if (this.deliveryStore.getGoalOutcomeTarget(record.id) !== undefined)
-                        return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
-                }
-                catch {
-                    return { outcome: 'not-sent', failureCode: 'goal-outcome-target-invalid', retryable: false };
-                }
-            }
-            return this.#nativeNoticeGuard(record.intent);
+        return Object.freeze({
+            source: `${key.channel}-channel`,
+            sourceEventId: `${key.account}/${input.eventId}`,
+            kind: 'message',
+            senderAllowlisted,
+            addressed: input.addressed,
+            threadFollowUp,
+            senderIsBot: input.senderIsBot,
+            groupMessage: conversation.kind === 'group',
+            ...(input.contentDigest === undefined ? {} : { contentDigest: input.contentDigest }),
+            // Only an opted-in observer sees the text, and only when it is the digested text.
+            ...(withText && input.contentDigest !== undefined && typeof input.text === 'string' && input.text.length <= MAX_INBOUND_INTAKE_TEXT
+                && createHash('sha256').update(input.text, 'utf8').digest('hex') === input.contentDigest ? { sourceText: input.text } : {}),
+            occurredAt: input.occurredAt,
+        });
+    }
+    notifyWorkItemReplyPending() {
+        try {
+            this.currentWorkItemReplyConsumer()?.onPending();
         }
-        let goalTarget;
+        catch (error) {
+            this.context.logger.warn(`assistant-delivery: work item reply wake failed: ${String(error)}`);
+        }
+    }
+    notifyWorkItemReplyCancellation(childIds) {
+        if (childIds.length === 0)
+            return;
         try {
-            goalTarget = this.deliveryStore.getGoalOutcomeTarget(record.id);
+            this.currentWorkItemReplyConsumer()?.onCancelled(Object.freeze([...childIds]));
         }
-        catch {
-            return { outcome: 'not-sent', failureCode: 'goal-outcome-target-invalid', retryable: false };
+        catch (error) {
+            this.context.logger.warn(`assistant-delivery: work item reply cancellation failed: ${String(error)}`);
         }
-        if (goalTarget !== undefined || metadata?.['dsh.learning.kind'] === 'goal-outcome') {
-            if (goalTarget === undefined) {
-                return { outcome: 'not-sent', failureCode: 'goal-outcome-target-missing', retryable: false };
+    }
+    inspectWorkItemReport(input, historical = false) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const binding = this.deliveryStore.getBinding(input.bindingId);
+        const owner = binding === undefined ? undefined : this.ownerLineageForBinding(binding);
+        if (!registration || input.sourceId !== registration.sourceId || !binding || (!historical && binding.status !== 'active') || !owner)
+            throw new Error('work item report producer or owner unavailable');
+        const target = registration.inspectReport({ itemId: input.itemId, reportRevision: input.reportRevision,
+            bindingId: binding.id, idempotencyKey: input.idempotencyKey, text: input.text, format: input.format ?? 'plain' });
+        if (!target || this.currentWorkItemReplyConsumer() !== registration || target.protocol !== 'assistant-delivery/work-item-report/v1'
+            || target.itemId !== input.itemId || target.reportRevision !== input.reportRevision || !Number.isSafeInteger(target.reportRevision) || target.reportRevision < 1
+            || typeof target.streamId !== 'string' || !target.streamId || !/^[a-f0-9]{64}$/u.test(target.reportDigest)
+            || target.sourceId !== registration.sourceId || target.scope.workspace !== binding.workspace || target.scope.preset !== binding.agentPreset
+            || workItemReplyCanonical(target.owner) !== workItemReplyCanonical(owner))
+            throw new Error('work item report target is not eligible');
+        return structuredClone(target);
+    }
+    enqueueWorkItemReport(input) {
+        this.assertActive();
+        if (containsReservedLearningMetadata(input.metadata) || Object.keys(input.metadata ?? {}).some(key => key.startsWith('dsh.native-notice') || key.startsWith(linkedReportMetadataPrefix))
+            || (typeof input.idempotencyKey === 'string' && input.idempotencyKey.startsWith(linkedReportKeyPrefix))) {
+            throw new AssistantDeliveryError('runtime-conflict', 'reserved metadata requires its typed delivery interface');
+        }
+        const target = this.inspectWorkItemReport(input);
+        if (input.workspace !== target.scope.workspace)
+            throw new Error('work item report scope changed');
+        return this.enqueueBackgroundAuthorized(input, target, { lane: 'work-item-report', lanePurpose: { purpose: 'result', workItemId: input.itemId } });
+    }
+    /**
+     * Host-only cross-channel route for one background work-item report.
+     *
+     * The origin binding always wins (default prefer): while it is active with an active
+     * principal this returns `{ route: 'origin' }` and enqueues nothing, so the
+     * caller keeps its existing origin path unchanged. Only when the origin is
+     * unavailable does the Host walk the owner's explicit `linkedFallback` list
+     * (Delivery principal ids, in order) and pick the first alias that is still
+     * an active `linked` row of the CURRENT owner record, with exactly one active
+     * binding in the origin workspace/preset, and that existing Policy already
+     * allows to receive this source's sends. The report is queued on the plain
+     * background lane, never the typed report lane, so a reply on the fallback
+     * channel can never continue or give feedback on the item. The queued row
+     * binds the owner and alias record versions plus the alias binding
+     * version/generation; the send-time guard drops it after any revoke or
+     * relink. A replay returns the first committed destination.
+     *
+     * Opt-in `prefer: 'recent'` instead ranks eligible aliases by the owner's
+     * newest inbound message (`inbox_messages.received_at`); an available origin
+     * still wins unless an eligible alias received strictly newer inbound, and
+     * also when that alias is refused before its linked row commits.
+     *
+     * Opt-in `ownerReportRouting.orderAcrossLanes` (Delivery config) keeps one
+     * item's reports in revision order across channels: when an earlier report
+     * of the same item is still unsettled, the new one sticks to that route
+     * (same origin, or same alias while it is still eligible and owner-listed)
+     * so the existing per-lane claim order sends it after. A sticky origin also
+     * overrides `prefer: 'recent'`. An unusable sticky route falls back to the
+     * rules above, so ordering never blocks delivery.
+     */
+    routeWorkItemReport(input) {
+        this.assertActive();
+        const sourceId = canonicalBackgroundSourceId(input.sourceId);
+        if (!Array.isArray(input.linkedFallback) || input.linkedFallback.length > maxLinkedReportFallback
+            || input.linkedFallback.some(id => typeof id !== 'string' || id.length === 0 || id.length > 256)
+            || typeof input.idempotencyKey !== 'string' || input.idempotencyKey.length === 0
+            || typeof input.itemId !== 'string' || input.itemId.length === 0
+            || !Number.isSafeInteger(input.reportRevision) || input.reportRevision < 1
+            || (input.prefer !== undefined && input.prefer !== 'origin' && input.prefer !== 'recent')) {
+            throw new AssistantDeliveryError('runtime-conflict', 'linked report route input is invalid');
+        }
+        const linkedKey = `${linkedReportKeyPrefix}${createHash('sha256').update(input.idempotencyKey).digest('hex')}`;
+        // Never send one report twice: a committed destination is final.
+        if (this.deliveryStore.getOutboxByIdempotencyKey(input.idempotencyKey) !== undefined)
+            return Object.freeze({ route: 'origin' });
+        const replay = this.deliveryStore.getOutboxByIdempotencyKey(linkedKey);
+        if (replay !== undefined) {
+            const metadata = replay.intent.metadata;
+            if (metadata?.[linkedReportMetadataPrefix] !== 'v1' || metadata[`${linkedReportMetadataPrefix}.sourceId`] !== sourceId
+                || metadata[`${linkedReportMetadataPrefix}.originBindingId`] !== input.originBindingId
+                || metadata[`${linkedReportMetadataPrefix}.itemId`] !== input.itemId
+                || metadata[`${linkedReportMetadataPrefix}.reportRevision`] !== String(input.reportRevision)) {
+                throw new AssistantDeliveryError('runtime-conflict', 'linked report idempotency key was reused for a different report');
             }
-            const locator = goalTarget.locator;
-            const proof = goalTarget.proof;
-            const binding = this.deliveryStore.getBinding(record.intent.bindingId);
-            const owner = binding === undefined ? undefined : this.deliveryStore.getPrincipal(binding.principal);
+            return Object.freeze({ route: 'linked', outbox: replay });
+        }
+        const origin = this.deliveryStore.getBinding(input.originBindingId);
+        if (origin === undefined || origin.workspace !== input.workspace) {
+            throw new AssistantDeliveryError('missing-binding', 'report origin binding does not exist');
+        }
+        const recent = input.prefer === 'recent';
+        // Replays returned above, so a sticky row is always another report of this item.
+        const sticky = this.config.ownerReportRouting?.orderAcrossLanes === true
+            ? this.deliveryStore.findUnsettledWorkItemReport({ sourceIds: [sourceId, input.sourceId], workspace: input.workspace,
+                originBindingId: origin.id, itemId: input.itemId, beforeRevision: input.reportRevision })
+            : undefined;
+        const stickyLinked = sticky?.route === 'linked';
+        // A sticky origin only orders a lane the caller can still address: after a
+        // `/new` rotation the frozen origin binding is revoked, so forcing it would
+        // make the caller's origin enqueue fail where `prefer: 'recent'` could have
+        // delivered on an alias. Fall through to normal routing in that case.
+        const originDirect = origin.status === 'active' && this.hasActivePrincipal(origin);
+        if (originDirect && !recent && !stickyLinked)
+            return Object.freeze({ route: 'origin' });
+        // A `/new` rotation revokes the origin and inserts a successor in the same
+        // conversation for the same principal. That origin is still available: keep
+        // the origin path (and its existing failure semantics) rather than reroute.
+        const successor = origin.status === 'active' ? undefined : this.deliveryStore.getActiveBinding(origin.conversation);
+        const originAvailable = originDirect || (successor !== undefined && successor.id !== origin.id
+            && successor.workspace === origin.workspace && successor.agentPreset === origin.agentPreset
+            && JSON.stringify(successor.principal) === JSON.stringify(origin.principal) && this.hasActivePrincipal(successor));
+        if (originAvailable && ((!recent && !stickyLinked) || (sticky?.route === 'origin' && originDirect)))
+            return Object.freeze({ route: 'origin' });
+        const owner = this.deliveryStore.getPrincipal(origin.principal);
+        if (owner?.status !== 'active' || owner.role !== 'owner' || JSON.stringify(owner.principal) !== JSON.stringify(origin.principal)) {
+            if (originAvailable)
+                return Object.freeze({ route: 'origin' });
+            throw new AssistantDeliveryError('missing-binding', 'report origin owner is no longer active');
+        }
+        const ownerId = externalPrincipalId(owner.principal);
+        const active = this.deliveryStore.listActiveBindings();
+        const eligible = (aliasId) => {
+            if (aliasId === ownerId)
+                return undefined;
+            const matches = active.filter(binding => externalPrincipalId(binding.principal) === aliasId
+                && binding.workspace === origin.workspace && binding.agentPreset === origin.agentPreset);
+            // Ambiguous alias channels are skipped rather than guessed.
+            if (matches.length !== 1)
+                return undefined;
+            const binding = matches[0];
+            const alias = this.deliveryStore.getPrincipal(binding.principal);
+            if (binding.id === origin.id || alias?.status !== 'active' || alias.role !== 'linked' || alias.linkedToId !== owner.id
+                || alias.id === owner.id || JSON.stringify(alias.principal) !== JSON.stringify(binding.principal))
+                return undefined;
+            if (!this.linkedReportSendAllowed(sourceId, binding))
+                return undefined;
+            return { binding, alias };
+        };
+        let picked;
+        if (stickyLinked) {
+            // Same alias binding only: a revoked, relinked, unlisted or ambiguous alias is not sticky.
+            const binding = this.deliveryStore.getBinding(sticky.bindingId);
+            const aliasId = binding === undefined ? undefined : externalPrincipalId(binding.principal);
+            const found = aliasId === undefined || !input.linkedFallback.includes(aliasId) ? undefined : eligible(aliasId);
+            // A kept alias queues behind the earlier report through the per-lane claim order.
+            if (found?.binding.id === sticky.bindingId)
+                picked = found;
+            else if (originAvailable && !recent)
+                return Object.freeze({ route: 'origin' });
+        }
+        const stickyPicked = picked !== undefined;
+        if (!stickyPicked && recent) {
+            // Opt-in: rank eligible aliases (one Policy evaluate each) by the owner's
+            // newest inbound message (stable sort keeps list order on ties). An
+            // available origin wins unless an eligible alias received strictly newer inbound.
+            const candidates = input.linkedFallback.flatMap(aliasId => {
+                const found = eligible(aliasId);
+                return found === undefined ? [] : [found];
+            });
+            const latest = this.deliveryStore.latestInboundAtByBinding([origin.id, ...candidates.map(candidate => candidate.binding.id)]);
+            const at = (bindingId) => latest.get(bindingId) ?? Number.NEGATIVE_INFINITY;
+            candidates.sort((left, right) => at(left.binding.id) === at(right.binding.id) ? 0 : at(left.binding.id) < at(right.binding.id) ? 1 : -1);
+            picked = candidates[0];
+            if (originAvailable && (picked === undefined || !(at(picked.binding.id) > at(origin.id))))
+                return Object.freeze({ route: 'origin' });
+        }
+        else if (!stickyPicked) {
+            for (const aliasId of input.linkedFallback) {
+                picked = eligible(aliasId);
+                if (picked !== undefined)
+                    break;
+            }
+        }
+        if (picked !== undefined) {
+            const { binding, alias } = picked;
+            let outbox;
             try {
-                if (proof.receipt.completedAt > Date.now() || proof.receipt.validUntil <= Date.now()) {
-                    throw new Error('goal outcome receipt expired');
+                outbox = this.enqueueBackgroundAuthorized({ sourceId, workspace: binding.workspace, bindingId: binding.id,
+                    idempotencyKey: linkedKey, text: input.text, format: input.format ?? 'plain', metadata: {
+                        [linkedReportMetadataPrefix]: 'v1',
+                        [`${linkedReportMetadataPrefix}.sourceId`]: sourceId,
+                        [`${linkedReportMetadataPrefix}.itemId`]: input.itemId,
+                        [`${linkedReportMetadataPrefix}.reportRevision`]: String(input.reportRevision),
+                        [`${linkedReportMetadataPrefix}.originBindingId`]: origin.id,
+                        [`${linkedReportMetadataPrefix}.ownerRecordId`]: owner.id,
+                        [`${linkedReportMetadataPrefix}.ownerVersion`]: String(owner.version),
+                        [`${linkedReportMetadataPrefix}.aliasRecordId`]: alias.id,
+                        [`${linkedReportMetadataPrefix}.aliasVersion`]: String(alias.version),
+                        [`${linkedReportMetadataPrefix}.bindingVersion`]: String(binding.version),
+                        [`${linkedReportMetadataPrefix}.bindingGeneration`]: String(binding.generation),
+                    } }, undefined, { lane: 'background', lanePurpose: { purpose: 'result', workItemId: input.itemId } });
+            }
+            catch (error) {
+                // `prefer: 'recent'` or a sticky alias with an available origin: a refusal raised before
+                // the linked row commits (Policy authorize deny, attention enforce,
+                // binding change) keeps the origin path instead of losing the report.
+                // A committed linked row is final and is never paired with an origin send.
+                if ((recent || stickyPicked) && originAvailable && error instanceof AssistantDeliveryError
+                    && this.deliveryStore.getOutboxByIdempotencyKey(linkedKey) === undefined)
+                    return Object.freeze({ route: 'origin' });
+                throw error;
+            }
+            return Object.freeze({ route: 'linked', outbox });
+        }
+        throw new AssistantDeliveryError('missing-binding', 'report origin is unavailable and no linked fallback is eligible');
+    }
+    linkedReportSendAllowed(sourceId, binding) {
+        return this.policy.evaluate({ subject: { kind: 'background', id: sourceId, workspace: binding.workspace,
+                principal: externalPrincipalId(binding.principal) }, action: 'send', resource: { kind: 'message', id: binding.id },
+            context: { initiator: 'background' } }).effect === 'allow';
+    }
+    /** Send-time re-check of a linked report route; any revoke, relink or Policy change drops it. */
+    linkedReportGuard(record) {
+        const metadata = record.intent.metadata;
+        const field = (name) => metadata?.[`${linkedReportMetadataPrefix}.${name}`];
+        try {
+            if (containsReservedLearningMetadata(metadata) || metadata?.[linkedReportMetadataPrefix] !== 'v1'
+                || !record.intent.idempotencyKey.startsWith(linkedReportKeyPrefix)
+                || (typeof record.id === 'string' && this.deliveryStore.getGoalOutcomeTarget(record.id) !== undefined))
+                throw new Error('linked report is invalid');
+            const binding = this.deliveryStore.getBinding(record.intent.bindingId);
+            const alias = binding === undefined ? undefined : this.deliveryStore.getPrincipal(binding.principal);
+            const origin = this.deliveryStore.getBinding(field('originBindingId') ?? '');
+            const owner = origin === undefined ? undefined : this.deliveryStore.getPrincipal(origin.principal);
+            if (binding?.status !== 'active' || String(binding.version) !== field('bindingVersion') || String(binding.generation) !== field('bindingGeneration')
+                || origin === undefined || binding.workspace !== origin.workspace || binding.agentPreset !== origin.agentPreset
+                || owner?.status !== 'active' || owner.role !== 'owner' || owner.id !== field('ownerRecordId') || String(owner.version) !== field('ownerVersion')
+                || alias?.status !== 'active' || alias.role !== 'linked' || alias.id !== field('aliasRecordId') || String(alias.version) !== field('aliasVersion')
+                || alias.linkedToId !== owner.id || !this.linkedReportSendAllowed(canonicalBackgroundSourceId(field('sourceId') ?? ''), binding)) {
+                throw new Error('linked report route changed');
+            }
+        }
+        catch {
+            return { outcome: 'not-sent', failureCode: 'linked-report-route-revoked', retryable: false };
+        }
+        return undefined;
+    }
+    workItemReplyPermission(binding, registration) {
+        return this.policy.evaluate({ subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+            action: 'continue-work-items-from-reply', resource: { kind: 'automation', id: registration.continuationAutomationId },
+            context: { initiator: 'external' } }).effect === 'allow';
+    }
+    /**
+     * Validate the continuation lane of one reply to an exact report without
+     * writing it. Mixed-intent admission reuses this report inside its combined
+     * transaction; the ordinary path admits it through `admitWorkItemReply`.
+     */
+    prepareWorkItemReply(inbox, binding) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const envelope = inbox.envelope;
+        if (!registration || registration.continuationEnabled === false || envelope.kind !== 'text' || envelope.text.trim().startsWith('/') || !envelope.text
+            || (envelope.attachments?.length ?? 0) > 0 || !envelope.metadata?.replyToProviderMessageId)
+            return undefined;
+        const report = this.deliveryStore.workItemReplies.replyReport(envelope.channel, envelope.account, envelope.metadata.replyToProviderMessageId);
+        const outbox = report?.outbox;
+        if (!report || !outbox || !['accepted', 'delivered', 'read'].includes(outbox.status) || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(binding.principal)
+            || workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation))
+            return undefined;
+        try {
+            const target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: report.target.itemId,
+                reportRevision: report.target.reportRevision, bindingId: outbox.intent.bindingId, idempotencyKey: outbox.intent.idempotencyKey,
+                text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
+            if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
+                return undefined;
+            if (registration.canContinueReport?.({ itemId: target.itemId, reportRevision: target.reportRevision, bindingId: outbox.intent.bindingId,
+                idempotencyKey: outbox.intent.idempotencyKey, text: outbox.intent.text, format: outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }) === false)
+                return undefined;
+            if (this.currentWorkItemReplyConsumer() !== registration || !this.workItemReplyPermission(binding, registration))
+                return undefined;
+        }
+        catch {
+            return undefined;
+        }
+        return report;
+    }
+    admitWorkItemReply(inbox, binding) {
+        const report = this.prepareWorkItemReply(inbox, binding);
+        if (report === undefined)
+            return false;
+        // From here a failed durable handoff is an error, never ordinary fallback.
+        this.deliveryStore.workItemReplies.admit(inbox.id, binding, report);
+        return true;
+    }
+    workItemReplyFence(source) {
+        const registration = this.currentWorkItemReplyConsumer();
+        const fresh = this.deliveryStore.workItemReplies.read({ id: source.id, expectedSourceDigest: source.sourceDigest });
+        if (workItemReplyCanonical(fresh) !== workItemReplyCanonical(source))
+            throw new Error('work item reply source state changed');
+        const binding = this.deliveryStore.getBinding(source.binding.id);
+        const inbox = this.deliveryStore.getInbox(source.id);
+        const report = this.deliveryStore.workItemReplies.report(source.target.outboxId);
+        if (!registration || registration.continuationEnabled === false || !binding || binding.status !== 'active' || binding.version !== source.binding.version || binding.generation !== source.binding.generation
+            || !inbox || inbox.status !== 'processed' || inbox.bindingId !== binding.id || !report
+            || inbox.envelope.text !== source.inputText || workItemReplyCanonical(inbox.admissionCursor) !== workItemReplyCanonical(source.admissionCursor)
+            || workItemReplyCanonical(this.ownerLineageForBinding(binding)) !== workItemReplyCanonical(source.owner)
+            || externalPrincipalId(binding.principal) !== source.principalId || binding.workspace !== source.scope.workspace || binding.agentPreset !== source.scope.preset
+            || !['accepted', 'delivered', 'read'].includes(report.outbox.status) || report.outbox.providerMessageId !== source.target.providerMessageId
+            || this.deliveryStore.workItemReplies.replyReport(binding.conversation.channel, binding.conversation.account, source.target.providerMessageId)?.outbox.id !== source.target.outboxId
+            || workItemReplyCanonical(report.outbox.intent.target.conversation) !== workItemReplyCanonical(inbox.envelope.conversation)
+            || !this.workItemReplyPermission(binding, registration))
+            throw new Error('work item reply owner, producer or policy unavailable');
+        return registration;
+    }
+    validateWorkItemReply(source) {
+        const registration = this.workItemReplyFence(source);
+        const report = this.deliveryStore.workItemReplies.report(source.target.outboxId);
+        const target = this.inspectWorkItemReport({ sourceId: registration.sourceId, itemId: source.target.itemId,
+            reportRevision: source.target.reportRevision, bindingId: report.outbox.intent.bindingId, idempotencyKey: report.outbox.intent.idempotencyKey,
+            text: report.outbox.intent.text, format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }, true);
+        if (workItemReplyCanonical(target) !== workItemReplyCanonical(report.target))
+            throw new Error('work item reply report changed');
+        if (registration.canContinueReport?.({ itemId: target.itemId, reportRevision: target.reportRevision, bindingId: report.outbox.intent.bindingId,
+            idempotencyKey: report.outbox.intent.idempotencyKey, text: report.outbox.intent.text, format: report.outbox.intent.format === 'markdown' ? 'markdown' : 'plain' }) === false)
+            throw new Error('report continuation authority expired');
+        if (this.workItemReplyFence(source) !== registration)
+            throw new Error('work item reply authority changed');
+    }
+    listPendingWorkItemReplies(input) {
+        this.assertActive();
+        if (!this.currentWorkItemReplyConsumer())
+            throw new Error('work item reply producer unavailable');
+        if (!Number.isSafeInteger(input.limit) || input.limit < 1 || input.limit > 100 || (input.afterSequence !== undefined && (!Number.isSafeInteger(input.afterSequence) || input.afterSequence < 0)))
+            throw new Error('invalid work item reply scan');
+        const raw = this.deliveryStore.workItemReplies.pending(input);
+        const hasMore = raw.length > input.limit;
+        const page = raw.slice(0, input.limit);
+        const eligible = page.filter(source => {
+            try {
+                this.validateWorkItemReply(source);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        });
+        return Object.freeze({ items: Object.freeze(eligible), hasMore, nextAfterSequence: hasMore ? page.at(-1).admissionCursor.sequence : null });
+    }
+    readWorkItemReply(input) {
+        this.assertActive();
+        const source = this.deliveryStore.workItemReplies.read(input);
+        this.validateWorkItemReply(source);
+        return source;
+    }
+    selectWorkItemReplyParent(input) {
+        this.assertActive();
+        return this.deliveryStore.workItemReplies.select(input, source => this.validateWorkItemReply(source));
+    }
+    acknowledgeWorkItemReply(input) {
+        this.assertActive();
+        const source = this.deliveryStore.workItemReplies.acknowledge(input, source => {
+            this.validateWorkItemReply(source);
+            const registration = this.currentWorkItemReplyConsumer();
+            if (!source.executionParentItemId || !registration || registration.inspectChild({ replyId: source.id, sourceDigest: source.sourceDigest,
+                parentItemId: source.executionParentItemId, childItemId: input.childItemId, childPlanDigest: input.childPlanDigest }) !== true
+                || this.workItemReplyFence(source) !== registration)
+                throw new Error('work item reply child is not durably verified');
+        });
+        this.notifyWorkItemReplyPending();
+        return source;
+    }
+    enqueueBackground(input) {
+        this.assertActive();
+        if (containsReservedLearningMetadata(input.metadata) || Object.keys(input.metadata ?? {}).some(key => key.startsWith('dsh.native-notice') || key.startsWith(linkedReportMetadataPrefix))
+            || (typeof input.idempotencyKey === 'string' && input.idempotencyKey.startsWith(linkedReportKeyPrefix))) {
+            throw new AssistantDeliveryError('runtime-conflict', 'reserved metadata requires its typed delivery interface');
+        }
+        return this.enqueueBackgroundAuthorized(input, undefined, { lane: 'background', envelope: input.attention });
+    }
+    /**
+     * Record the WP19 stage-1 verdict for one queued Outbox record. Audit only:
+     * the record is returned unchanged and any audit failure is swallowed.
+     */
+    auditAttention(lane, sourceId, audit, record) {
+        try {
+            this.deliveryStore.attentionAudit.record({ outboxId: record.id, bindingId: record.intent.bindingId, lane, sourceId }, ledger => assessAttention({ text: record.intent.attachment?.text ?? record.intent.text, ...(audit.envelope === undefined ? {} : { envelope: audit.envelope }),
+                ...(audit.lanePurpose === undefined ? {} : { lanePurpose: audit.lanePurpose }), ledger }));
+        }
+        catch {
+            this.attentionAuditWriteFailures += 1;
+        }
+        return record;
+    }
+    /**
+     * WP19 stage 2b, only when `attentionAttachOverCap` is on: convert an
+     * over-cap notice to a short body plus one text attachment (never split),
+     * and reject an inline notice that, with recent inline notices from the same
+     * source, binding and lane, exceeds the cap of its purpose. Deterministic for
+     * one (input, audited history, clock). Off: the input is returned unchanged,
+     * except that a replay of an already converted key keeps its stored form.
+     * WP19 stage 3, only when `attentionEnforce` is on: a new notice with a
+     * missing or failed purpose, or over cap without the attachment path, is
+     * rejected with `AttentionRejectedError` and nothing is queued. Replays
+     * return above before any check, so an existing key stays idempotent.
+     */
+    prepareAttentionDelivery(input) {
+        const unchanged = { text: input.text, format: input.format };
+        let winner;
+        try {
+            winner = this.deliveryStore.getOutboxByIdempotencyKey(input.idempotencyKey);
+        }
+        catch {
+            winner = undefined;
+        }
+        // A replay keeps the stored form even after the flag is turned off, so a converted row
+        // stays idempotent; the store still rejects a changed intent under the same key.
+        if (winner !== undefined) {
+            const stored = winner.intent.attachment;
+            return stored !== undefined && stored.text === input.text && stored.mediaType === (input.format === 'markdown' ? 'text/markdown' : 'text/plain')
+                ? { text: winner.intent.text, format: 'plain', attachment: stored } : unchanged;
+        }
+        const attach = this.config.attentionAttachOverCap === true;
+        const enforce = this.config.attentionEnforce === true;
+        if (!attach && !enforce)
+            return unchanged;
+        const binding = typeof input.binding === 'function' ? input.binding() : input.binding;
+        // No active binding: the store rejects the enqueue with its usual error.
+        if (binding === undefined)
+            return unchanged;
+        const assessment = assessAttention({ text: input.text, ...(input.envelope === undefined ? {} : { envelope: input.envelope }),
+            ...(input.lanePurpose === undefined ? {} : { lanePurpose: input.lanePurpose }),
+            ledger: this.deliveryStore.attentionAudit.ledger(binding.id) });
+        const purpose = assessment.purpose;
+        // Stage 3: every rejection is recorded before it is thrown; without enforcement the stage 2b errors stay as they were.
+        const reject = (reasons, message) => {
+            if (!enforce)
+                throw new AssistantDeliveryError('policy-denied', message);
+            throw new AttentionRejectedError(this.attentionRejections.record({ bindingId: binding.id, lane: input.lane, sourceId: input.sourceId,
+                idempotencyKey: input.idempotencyKey, assessment, reasons }), message);
+        };
+        if (enforce) {
+            const reasons = attentionEnforcementReasons(assessment, attach);
+            if (reasons.length > 0)
+                reject(reasons);
+        }
+        let delivered = unchanged;
+        if (attach && attentionOverCap(input.text, purpose)) {
+            const adapter = this.registry.get(binding.conversation.channel, binding.conversation.account);
+            if (adapter === undefined) {
+                throw new AssistantDeliveryError('runtime-unavailable', 'over-cap notice needs its channel adapter to attach the full text');
+            }
+            if (adapter.capabilities.textAttachments !== true) {
+                reject([...assessment.reasons.filter(reason => reason === 'over-word-cap' || reason === 'over-grapheme-cap'), 'attachment-unsupported'], 'over-cap notice cannot be attached: the channel does not accept text attachments');
+            }
+            delivered = convertOverCapAttention({ text: input.text, format: input.format,
+                digest: text => createHash('sha256').update(text).digest('hex') });
+        }
+        // Split evasion is a stage 2b check; enforcement alone does not add it.
+        if (!attach)
+            return delivered;
+        const split = assessAttentionSplit({ text: delivered.text, purpose, priorInlineTexts: this.deliveryStore.attentionAudit.recentInlineTexts({
+                bindingId: binding.id, lane: input.lane, sourceId: input.sourceId, windowMs: attentionSplitWindowMs
+            }) });
+        if (split.split) {
+            reject(['split-evasion'], `attention split evasion: ${split.priorNotices} recent notice(s) from this source plus this one exceed the ${purpose} cap; send one notice`);
+        }
+        return delivered;
+    }
+    /**
+     * Read-only WP19 stage-1 audit page in append order; never exposes message text.
+     * `processLocalWriteFailures` counts failed audit writes since this Host started;
+     * `unauditedOutbox` is derived from durable rows on every call (see
+     * `AttentionAuditStore.unauditedOutboxCount` for which lanes it can see).
+     */
+    inspectAttentionAudit(input = {}) {
+        this.assertActive();
+        const afterSequence = input.afterSequence ?? 0;
+        const limit = input.limit ?? 100;
+        if (!Number.isSafeInteger(afterSequence) || afterSequence < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid attention audit scan');
+        }
+        const page = this.deliveryStore.attentionAudit.list(afterSequence, limit);
+        return Object.freeze({ entries: page.entries, hasMore: page.hasMore,
+            nextAfterSequence: page.hasMore ? page.entries.at(-1).sequence : null,
+            processLocalWriteFailures: this.attentionAuditWriteFailures, unauditedOutbox: this.deliveryStore.attentionAudit.unauditedOutboxCount() });
+    }
+    /**
+     * WP22 read adapter for Evaluation: per-notification durable facts (transport,
+     * owner reply, current owner judgement) keyed by audited Outbox id. Read-only,
+     * text-free, and classification-free. Pass `outboxIds` (max 500) to refresh
+     * known notifications, or `afterSequence`/`limit` to page new audit rows.
+     */
+    inspectNotificationOutcomeFacts(input = {}) {
+        this.assertActive();
+        if (input.outboxIds !== undefined) {
+            if (!Array.isArray(input.outboxIds) || input.outboxIds.length > 500 || input.afterSequence !== undefined || input.limit !== undefined
+                || !input.outboxIds.every(id => typeof id === 'string' && id.length > 0 && id.length <= 256)) {
+                throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome lookup');
+            }
+            return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL,
+                facts: this.deliveryStore.attentionAudit.outcomeFactsFor([...new Set(input.outboxIds)]), hasMore: false, nextAfterSequence: null });
+        }
+        const afterSequence = input.afterSequence ?? 0;
+        const limit = input.limit ?? 100;
+        if (!Number.isSafeInteger(afterSequence) || afterSequence < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid notification outcome scan');
+        }
+        const page = this.deliveryStore.attentionAudit.list(afterSequence, limit);
+        const facts = this.deliveryStore.attentionAudit.outcomeFactsFor(page.entries.map(entry => entry.outboxId));
+        return Object.freeze({ protocol: NOTIFICATION_OUTCOME_FACTS_PROTOCOL, facts, hasMore: page.hasMore,
+            nextAfterSequence: page.entries.length === 0 ? null : page.entries.at(-1).sequence });
+    }
+    /**
+     * Read-only WP19 stage-2c progress audit page in append order; never exposes
+     * progress text. Entries are process-local (`durable: false`), bounded, and
+     * reset on Host restart; `processLocalWriteFailures` counts failed records.
+     */
+    inspectProgressAttentionAudit(input = {}) {
+        this.assertActive();
+        const afterSequence = input.afterSequence ?? 0;
+        const limit = input.limit ?? 100;
+        if (!Number.isSafeInteger(afterSequence) || afterSequence < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid progress attention audit scan');
+        }
+        return Object.freeze({ ...this.progressAttentionAudit.list(afterSequence, limit),
+            processLocalWriteFailures: this.progressAttentionAuditFailures });
+    }
+    /**
+     * Read-only WP19 stage-3 rejection page in append order; never exposes
+     * message text. Entries are process-local (`durable: false`), bounded, and
+     * reset on Host restart. Empty while `attentionEnforce` is off.
+     */
+    inspectAttentionRejections(input = {}) {
+        this.assertActive();
+        const afterSequence = input.afterSequence ?? 0;
+        const limit = input.limit ?? 100;
+        if (!Number.isSafeInteger(afterSequence) || afterSequence < 0 || !Number.isSafeInteger(limit) || limit < 1 || limit > 500) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid attention rejection scan');
+        }
+        return this.attentionRejections.list(afterSequence, limit);
+    }
+    enqueueBackgroundAuthorized(input, reportTarget, audit) {
+        const binding = this.deliveryStore.getBinding(input.bindingId);
+        if (binding === undefined || binding.status !== 'active' || !this.hasActivePrincipal(binding)) {
+            throw new AssistantDeliveryError('missing-binding', 'delivery binding does not exist or is revoked');
+        }
+        if (binding.workspace !== input.workspace) {
+            throw new AssistantDeliveryError('missing-binding', 'delivery workspace does not match the active binding');
+        }
+        const prepare = () => this.prepareAttentionDelivery({ ...audit, sourceId: input.sourceId, binding,
+            idempotencyKey: input.idempotencyKey, text: input.text, format: input.format ?? 'plain' });
+        // Stage 3: the attention verdict is pure over the audited ledger, so an enforced
+        // rejection happens before Policy writes its allow row or spends budget.
+        const early = this.config.attentionEnforce === true ? prepare() : undefined;
+        const decision = this.policy.authorize({ subject: { kind: 'background', id: input.sourceId,
+                workspace: input.workspace, principal: externalPrincipalId(binding.principal) }, action: 'send',
+            resource: { kind: 'message', id: binding.id }, context: { initiator: 'background' } }, { idempotencyKey: `message-send:${input.idempotencyKey}` });
+        if (decision.effect !== 'allow')
+            throw policyDenied(decision);
+        if (!this.hasActivePrincipal(binding)) {
+            throw new AssistantDeliveryError('missing-binding', 'delivery binding principal is no longer active');
+        }
+        const delivered = early ?? prepare();
+        const enqueue = () => this.deliveryStore.enqueue({ idempotencyKey: input.idempotencyKey, bindingId: binding.id,
+            target: { conversation: binding.conversation, principal: binding.principal }, ...delivered,
+            ...(input.metadata === undefined ? {} : { metadata: input.metadata }) });
+        return this.auditAttention(audit.lane, input.sourceId, audit, reportTarget === undefined ? enqueue() : this.deliveryStore.workItemReplies.enqueueReport(reportTarget, binding, enqueue));
+    }
+    /** `withdrawal: false` is for listing already-accepted notices; every send path keeps the default. */
+    #notificationGuard(record, options = { withdrawal: true }) {
+        const key = record.intent.idempotencyKey;
+        if (key.startsWith('inbound:') && (key.endsWith(':maintenance') || key.endsWith(':maintenance-failed'))) {
+            try {
+                const failed = key.endsWith(':maintenance-failed');
+                const inboxId = key.slice('inbound:'.length, -(failed ? ':maintenance-failed'.length : ':maintenance'.length));
+                const request = this.restartStore?.getRequestForTask(inboxId);
+                const task = this.restartStore?.getTask(inboxId);
+                const inbox = this.deliveryStore.getInbox(inboxId);
+                const binding = this.deliveryStore.getBinding(record.intent.bindingId);
+                if (request === undefined || task === undefined || inbox === undefined || binding === undefined
+                    || request.status === 'cancelled' || (failed ? request.status !== 'failed' : !this.restartAuthorized(request))
+                    || task.binding.id !== binding.id || task.binding.version !== binding.version || task.binding.generation !== binding.generation
+                    || task.owner.principalRecordId !== this.ownerLineageForBinding(binding)?.principalRecordId
+                    || task.owner.principalVersion !== this.ownerLineageForBinding(binding)?.principalVersion
+                    || inbox.bindingId !== binding.id || inbox.eventId !== record.intent.replyToEventId
+                    || !this.isInboundAuthorized(binding, inbox.envelope)
+                    || this.deliveryStore.getOutboxByIdempotencyKey(`inbound:${inbox.id}:reply`) !== undefined
+                    || this.deliveryStore.getOutboxByIdempotencyKey(`inbound:${inbox.eventId}:reply`) !== undefined)
+                    throw new Error('maintenance notice is stale');
+                const decision = this.policy.evaluate({ subject: { kind: 'agent', id: binding.agentPreset,
+                        workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+                    action: 'reply', resource: { kind: 'message', id: binding.id }, context: { initiator: 'external' } });
+                if (decision.effect !== 'allow')
+                    throw new Error('maintenance notice permission changed');
+            }
+            catch {
+                return { outcome: 'not-sent', failureCode: 'maintenance-notice-stale', retryable: false };
+            }
+            return undefined;
+        }
+        if (key.startsWith('inbound:') && key.endsWith(':interrupted')) {
+            try {
+                const inboxId = key.slice('inbound:'.length, -':interrupted'.length);
+                const inbox = this.deliveryStore.getInbox(inboxId);
+                const binding = this.deliveryStore.getBinding(record.intent.bindingId);
+                const expectedNotice = inbox?.failureCode === 'agent-task-timeout'
+                    ? timedOutTurnNotice : interruptedTurnNotice;
+                if (record.intent.text !== expectedNotice || inbox === undefined || binding === undefined
+                    || !this.deliveryStore.canSendInterruptedInboxNotice(record)
+                    || !this.isInboundAuthorized(binding, inbox.envelope)) {
+                    throw new Error('interrupted Inbox authority changed');
+                }
+                const reply = this.policy.evaluate({
+                    subject: { kind: 'agent', id: binding.agentPreset, workspace: binding.workspace,
+                        principal: externalPrincipalId(binding.principal) },
+                    action: 'reply', resource: { kind: 'message', id: binding.id },
+                    context: { initiator: 'external' },
+                });
+                if (reply.effect !== 'allow')
+                    throw new Error('interrupted Inbox reply authority changed');
+            }
+            catch {
+                return { outcome: 'not-sent', failureCode: 'interrupted-inbox-authority-revoked', retryable: false };
+            }
+            return undefined;
+        }
+        const metadata = record.intent.metadata;
+        const nativeKeys = Object.keys(metadata ?? {}).filter(key => key.startsWith('dsh.native-notice'));
+        if (nativeKeys.length > 0) {
+            // Native adapter sends receive only an intent, so never bind a fabricated
+            // outbox id into the goal-outcome sidecar lookup. A persisted record still
+            // rejects any sidecar collision before native authority is considered.
+            if (containsReservedLearningMetadata(metadata))
+                return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
+            if (typeof record.id === 'string') {
+                try {
+                    if (this.deliveryStore.getGoalOutcomeTarget(record.id) !== undefined)
+                        return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
+                }
+                catch {
+                    return { outcome: 'not-sent', failureCode: 'goal-outcome-target-invalid', retryable: false };
+                }
+            }
+            return this.#nativeNoticeGuard(record.intent, options);
+        }
+        if (Object.keys(metadata ?? {}).some(key => key.startsWith(linkedReportMetadataPrefix)))
+            return this.linkedReportGuard(record);
+        let goalTarget;
+        try {
+            goalTarget = this.deliveryStore.getGoalOutcomeTarget(record.id);
+        }
+        catch {
+            return { outcome: 'not-sent', failureCode: 'goal-outcome-target-invalid', retryable: false };
+        }
+        if (goalTarget !== undefined || metadata?.['dsh.learning.kind'] === 'goal-outcome') {
+            if (goalTarget === undefined) {
+                return { outcome: 'not-sent', failureCode: 'goal-outcome-target-missing', retryable: false };
+            }
+            const locator = goalTarget.locator;
+            const proof = goalTarget.proof;
+            const binding = this.deliveryStore.getBinding(record.intent.bindingId);
+            const owner = binding === undefined ? undefined : this.deliveryStore.getPrincipal(binding.principal);
+            try {
+                if (proof.receipt.completedAt > Date.now() || proof.receipt.validUntil <= Date.now()) {
+                    throw new Error('goal outcome receipt expired');
                 }
                 // One captured service reference must both issue and resolve the
                 // process-local capability. A replacement cannot inherit authority.
@@ -4248,7 +5470,7 @@ export class AssistantDeliveryService extends Service {
         }
         return undefined;
     }
-    #nativeNoticeGuard(intent) {
+    #nativeNoticeGuard(intent, options = { withdrawal: true }) {
         const metadata = intent.metadata;
         const nativeKeys = Object.keys(metadata ?? {}).filter(key => key.startsWith('dsh.native-notice'));
         if (nativeKeys.length === 0 || containsReservedLearningMetadata(metadata))
@@ -4274,6 +5496,30 @@ export class AssistantDeliveryService extends Service {
         catch {
             return { outcome: 'not-sent', failureCode: 'native-notice-policy-revoked', retryable: false };
         }
+        const withdrawable = metadata['dsh.native-notice.withdrawable'];
+        const authority = metadata['dsh.native-notice.withdrawalAuthority'];
+        if (withdrawable !== undefined || authority !== undefined) {
+            if (withdrawable !== 'v1' || typeof authority !== 'string' || !ownerNotificationAuthorityPattern.test(authority))
+                return { outcome: 'not-sent', failureCode: 'native-notice-invalid', retryable: false };
+            if (options.withdrawal) {
+                // Fail closed: without a live check that the authority's current
+                // service still vouches for, the notice waits (retryable, bounded by
+                // its expiry) instead of sending. A foreign registration under another
+                // authority is a different key and never reaches this notice.
+                let withdrawn;
+                try {
+                    const live = this.ownerNotificationWithdrawals.get(ownerNotificationWithdrawalKey(authority, canonicalBackgroundSourceId(metadata['dsh.native-notice.sourceId'])));
+                    if (live === undefined || !this.withdrawalVouched(live.authority, live.registration))
+                        return { outcome: 'not-sent', failureCode: 'native-notice-withdrawal-unavailable', retryable: true };
+                    withdrawn = live.registration.isWithdrawn(intent.idempotencyKey);
+                }
+                catch {
+                    return { outcome: 'not-sent', failureCode: 'native-notice-withdrawal-unavailable', retryable: true };
+                }
+                if (withdrawn !== false)
+                    return { outcome: 'not-sent', failureCode: 'native-notice-withdrawn', retryable: false };
+            }
+        }
         return undefined;
     }
     #notificationProviderId(intent) { return `native-notice:${createHash('sha256').update(intent.idempotencyKey).update('\u0000').update(intent.bindingId).update('\u0000').update(intent.text).digest('hex')}`; }
@@ -4282,6 +5528,15 @@ export class AssistantDeliveryService extends Service {
         this.assertActive();
         if (!Number.isSafeInteger(input.expiresAt) || input.expiresAt <= Date.now() || typeof input.text !== 'string' || input.text.length === 0 || input.text.length > 16_384)
             throw new AssistantDeliveryError('policy-denied', 'owner notification is invalid or expired');
+        if (input.withdrawable !== undefined && typeof input.withdrawable !== 'boolean')
+            throw new AssistantDeliveryError('policy-denied', 'owner notification is invalid or expired');
+        if (input.withdrawalHandle !== undefined && input.withdrawable !== true)
+            throw new AssistantDeliveryError('policy-denied', 'owner notification is invalid or expired');
+        // A withdrawable notice must present a live handle for its own source; the
+        // notice is then bound to that handle's authority, which alone controls it.
+        const withdrawal = input.withdrawable === true ? this.liveWithdrawal(input.withdrawalHandle, input.sourceId) : undefined;
+        if (input.withdrawable === true && withdrawal === undefined)
+            throw new AssistantDeliveryError('policy-denied', 'owner notification withdrawal is not registered for this source');
         const resolved = this.resolveOwnerRoute(input.ownerRouteId);
         const binding = resolved.binding;
         const owner = this.deliveryStore.getPrincipal(binding.principal);
@@ -4291,8 +5546,251 @@ export class AssistantDeliveryService extends Service {
         return this.enqueueBackgroundAuthorized({ sourceId: input.sourceId, workspace: binding.workspace, bindingId: binding.id, idempotencyKey: input.idempotencyKey, text: input.text, format: 'plain', metadata: {
                 'dsh.native-notice': 'v1', 'dsh.native-notice.sourceId': input.sourceId, 'dsh.native-notice.ownerRouteId': input.ownerRouteId, 'dsh.native-notice.expiresAt': String(input.expiresAt), 'dsh.native-notice.ownerRecordId': owner.id,
                 'dsh.native-notice.ownerVersion': String(owner.version), 'dsh.native-notice.bindingVersion': String(binding.version), 'dsh.native-notice.bindingGeneration': String(binding.generation), 'dsh.native-notice.sessionId': binding.sessionId,
+                ...(withdrawal !== undefined ? { 'dsh.native-notice.withdrawable': 'v1', 'dsh.native-notice.withdrawalAuthority': withdrawal.authority } : {}),
+            } }, undefined, { lane: 'owner-notification', envelope: input.attention });
+    }
+    /**
+     * Register the send-time withdrawal check for one owner-notice source (see
+     * `OwnerNotificationWithdrawal`). The service in the `authority` slot must
+     * vouch for the registration; one live check per (authority, source). A
+     * registration its authority no longer vouches for (owner restarted or
+     * replaced) is superseded by the next vouched one, so the legitimate owner
+     * regains control of notices already queued under its authority. After
+     * `unregister`, those notices wait instead of sending.
+     */
+    registerOwnerNotificationWithdrawal(registration) {
+        this.assertActive();
+        if (!registration || registration.protocol !== ownerNotificationWithdrawalProtocol || typeof registration.isWithdrawn !== 'function'
+            || typeof registration.sourceId !== 'string' || typeof registration.authority !== 'string' || !ownerNotificationAuthorityPattern.test(registration.authority)) {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid owner notification withdrawal');
+        }
+        const authority = registration.authority;
+        const sourceId = canonicalBackgroundSourceId(registration.sourceId);
+        if (!this.withdrawalVouched(authority, registration))
+            throw new AssistantDeliveryError('runtime-conflict', 'owner notification withdrawal is not owned by its authority');
+        const key = ownerNotificationWithdrawalKey(authority, sourceId);
+        const existing = this.ownerNotificationWithdrawals.get(key);
+        if (existing !== undefined) {
+            if (this.withdrawalVouched(existing.authority, existing.registration))
+                throw new AssistantDeliveryError('runtime-conflict', 'owner notification withdrawal already registered');
+            this.ownerNotificationWithdrawalHandles.delete(existing.handle);
+        }
+        const handle = randomBytes(32).toString('base64url');
+        const entry = Object.freeze({ handle, authority, sourceId, registration });
+        this.ownerNotificationWithdrawals.set(key, entry);
+        this.ownerNotificationWithdrawalHandles.set(handle, key);
+        let live = true;
+        return Object.freeze({ handle, unregister: () => {
+                if (!live)
+                    return;
+                live = false;
+                this.ownerNotificationWithdrawalHandles.delete(handle);
+                if (this.ownerNotificationWithdrawals.get(key) === entry)
+                    this.ownerNotificationWithdrawals.delete(key);
             } });
     }
+    /** The service now in `authority`'s slot vouches for this exact registration object. */
+    withdrawalVouched(authority, registration) {
+        try {
+            const owner = this.context.get(authority, false);
+            return typeof owner?.ownsOwnerNotificationWithdrawal === 'function' && owner.ownsOwnerNotificationWithdrawal(registration) === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Live, still-vouched registration behind `handle`, for exactly `sourceId`. */
+    liveWithdrawal(handle, sourceId) {
+        if (typeof handle !== 'string')
+            return undefined;
+        const key = this.ownerNotificationWithdrawalHandles.get(handle);
+        const entry = key === undefined ? undefined : this.ownerNotificationWithdrawals.get(key);
+        if (entry === undefined || entry.handle !== handle || !this.withdrawalVouched(entry.authority, entry.registration))
+            return undefined;
+        let canonical;
+        try {
+            canonical = canonicalBackgroundSourceId(sourceId);
+        }
+        catch {
+            return undefined;
+        }
+        return canonical === entry.sourceId ? entry : undefined;
+    }
+    /**
+     * Read-only lookup of an owner notice by idempotency key. The caller
+     * presents its withdrawal handle; the lookup is scoped to that handle's
+     * source and authority. A key held by another source, another authority,
+     * a non-withdrawable notice or a non-notice record reads as absent. Never
+     * returns text or metadata.
+     */
+    inspectOwnerNotification(input) {
+        this.assertActive();
+        if (typeof input?.idempotencyKey !== 'string' || input.idempotencyKey.length === 0 || input.idempotencyKey.length > 256)
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid owner notification lookup');
+        const withdrawal = this.liveWithdrawal(input.withdrawalHandle, input.sourceId);
+        if (withdrawal === undefined)
+            throw new AssistantDeliveryError('runtime-conflict', 'owner notification withdrawal is not registered for this source');
+        const record = this.deliveryStore.getOutboxByIdempotencyKey(input.idempotencyKey);
+        const metadata = record?.intent.metadata;
+        if (record === undefined || metadata?.['dsh.native-notice'] !== 'v1' || typeof metadata['dsh.native-notice.sourceId'] !== 'string')
+            return undefined;
+        let stored;
+        try {
+            stored = canonicalBackgroundSourceId(metadata['dsh.native-notice.sourceId']);
+        }
+        catch {
+            return undefined;
+        }
+        if (stored !== withdrawal.sourceId)
+            return undefined;
+        // A row this authority did not queue (another authority, or no withdrawal
+        // binding at all) reads as absent, so the caller never adopts it.
+        if (metadata['dsh.native-notice.withdrawalAuthority'] !== withdrawal.authority)
+            return undefined;
+        return Object.freeze({ outboxId: record.id, status: record.status });
+    }
+    /**
+     * Register the slice-5 reply consumer for one owner-notice source (see
+     * `OwnerNotificationReply`). The service in the `authority` slot must vouch
+     * for the exact object; one live consumer per (authority, source). A
+     * registration its authority no longer vouches for is superseded by the
+     * next vouched one, so a restarted owner regains its replies without a new
+     * notice. Registering never sends anything and grants no send authority.
+     */
+    registerOwnerNotificationReply(registration) {
+        this.assertActive();
+        if (!registration || registration.protocol !== ownerNotificationReplyProtocol
+            || typeof registration.authority !== 'string' || !ownerNotificationAuthorityPattern.test(registration.authority)
+            || typeof registration.sourceId !== 'string' || typeof registration.idempotencyKeyPrefix !== 'string'
+            || registration.idempotencyKeyPrefix.length < 1 || registration.idempotencyKeyPrefix.length > 128
+            || typeof registration.consume !== 'function') {
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid owner notification reply consumer');
+        }
+        const authority = registration.authority;
+        const sourceId = canonicalBackgroundSourceId(registration.sourceId);
+        if (!this.replyVouched(authority, registration))
+            throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply is not owned by its authority');
+        const key = ownerNotificationWithdrawalKey(authority, sourceId);
+        const existing = this.ownerNotificationReplies.get(key);
+        if (existing !== undefined) {
+            if (this.replyVouched(existing.authority, existing.registration))
+                throw new AssistantDeliveryError('runtime-conflict', 'owner notification reply already registered');
+            this.ownerNotificationReplies.delete(key);
+        }
+        const entry = Object.freeze({ authority, sourceId, registration });
+        this.ownerNotificationReplies.set(key, entry);
+        let live = true;
+        return Object.freeze({ unregister: () => {
+                if (!live)
+                    return;
+                live = false;
+                if (this.ownerNotificationReplies.get(key) === entry)
+                    this.ownerNotificationReplies.delete(key);
+            } });
+    }
+    /** The service now in `authority`'s slot vouches for this exact reply registration. */
+    replyVouched(authority, registration) {
+        try {
+            const owner = this.context.get(authority, false);
+            return typeof owner?.ownsOwnerNotificationReply === 'function' && owner.ownsOwnerNotificationReply(registration) === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Slice 5 matcher: bind one authenticated inbound text reply to exactly one
+     * accepted/delivered/read owner notice through `replyToProviderMessageId`,
+     * require the live registered consumer's source and idempotency-key prefix,
+     * an active owner binding/principal with the notice's frozen owner lineage,
+     * and an `allow` external `answer-attention-question` Policy decision. On
+     * `applied` the Inbox is marked processed; `transient` leaves it pending for
+     * a retry. Everything else falls through to ordinary inbound handling.
+     */
+    inspectOwnerQuestionReply(inbox, binding) {
+        this.assertActive();
+        const envelope = inbox.envelope;
+        const replyTo = envelope.metadata?.replyToProviderMessageId;
+        if (typeof replyTo !== 'string' || replyTo.length === 0 || envelope.kind !== 'text' || (envelope.attachments?.length ?? 0) > 0)
+            return 'none';
+        if (typeof envelope.text !== 'string' || envelope.text.length === 0 || Buffer.byteLength(envelope.text, 'utf8') > 256)
+            return 'none';
+        // The reply must come from the active owner binding itself, not another
+        // conversation that happens to quote the provider message id.
+        if (binding.status !== 'active' || externalPrincipalId(binding.principal) !== externalPrincipalId(envelope.principal)
+            || workItemReplyCanonical(envelope.conversation) !== workItemReplyCanonical(binding.conversation))
+            return 'none';
+        const active = this.deliveryStore.getActiveBinding(binding.conversation);
+        if (active?.id !== binding.id)
+            return 'none';
+        const owner = this.deliveryStore.getPrincipal(binding.principal);
+        if (owner?.status !== 'active' || owner.role !== 'owner')
+            return 'none';
+        let outbox;
+        try {
+            outbox = this.deliveryStore.getUniqueOutboxByProviderMessage(inbox.channel, inbox.account, replyTo);
+        }
+        catch {
+            return 'none';
+        }
+        if (outbox === undefined || !['accepted', 'delivered', 'read'].includes(outbox.status))
+            return 'none';
+        const metadata = outbox.intent.metadata;
+        if (metadata?.['dsh.native-notice'] !== 'v1' || typeof metadata['dsh.native-notice.sourceId'] !== 'string'
+            || typeof metadata['dsh.native-notice.withdrawalAuthority'] !== 'string')
+            return 'none';
+        let sourceId;
+        try {
+            sourceId = canonicalBackgroundSourceId(metadata['dsh.native-notice.sourceId']);
+        }
+        catch {
+            return 'none';
+        }
+        const entry = this.ownerNotificationReplies.get(ownerNotificationWithdrawalKey(metadata['dsh.native-notice.withdrawalAuthority'], sourceId));
+        if (entry === undefined || !this.replyVouched(entry.authority, entry.registration))
+            return 'none';
+        const registration = entry.registration;
+        if (!outbox.intent.idempotencyKey.startsWith(registration.idempotencyKeyPrefix))
+            return 'none';
+        if (workItemReplyCanonical(outbox.intent.target.conversation) !== workItemReplyCanonical(envelope.conversation)
+            || workItemReplyCanonical(outbox.intent.target.principal) !== workItemReplyCanonical(envelope.principal))
+            return 'none';
+        // The notice froze an exact owner row; a re-paired/replaced owner does not
+        // inherit permission to answer the old owner's question.
+        if (metadata['dsh.native-notice.ownerRecordId'] !== owner.id
+            || metadata['dsh.native-notice.ownerVersion'] !== String(owner.version))
+            return 'none';
+        const decision = this.policy.evaluate({
+            subject: { kind: 'external', id: externalPrincipalId(binding.principal), workspace: binding.workspace, principal: externalPrincipalId(binding.principal) },
+            action: 'answer-attention-question', resource: { kind: 'message', id: binding.id }, context: { initiator: 'external' },
+        });
+        if (decision.effect !== 'allow')
+            return 'none';
+        let outcome;
+        try {
+            outcome = registration.consume(Object.freeze({
+                inboxId: inbox.id, envelopeHash: inbox.envelopeHash, outboxId: outbox.id, providerMessageId: replyTo,
+                idempotencyKey: outbox.intent.idempotencyKey, sourceId, principalId: externalPrincipalId(binding.principal),
+                text: envelope.text, receivedAt: inbox.receivedAt,
+            }));
+        }
+        catch {
+            return 'transient';
+        }
+        if (outcome === 'ignored')
+            return 'none';
+        if (outcome !== 'applied')
+            return 'transient';
+        try {
+            this.deliveryStore.markInboxProcessed(inbox.id, binding.id);
+        }
+        catch {
+            // The consumer's own durable effect already committed; if recording that
+            // here fails, never fall through and send the authorization to the Agent.
+            return this.deliveryStore.getInbox(inbox.id)?.status === 'processed' ? 'handled' : 'transient';
+        }
+        return 'handled';
+    }
     /**
      * Dedicated Automation result lane. Every learning field is derived from an
      * authoritative Automations receipt; callers cannot supply metadata,
@@ -4349,7 +5847,7 @@ export class AssistantDeliveryService extends Service {
         if (Buffer.byteLength(text, 'utf8') > this.config.maxTextBytes) {
             throw new AssistantDeliveryError('runtime-conflict', 'Automation result exceeds the delivery text limit');
         }
-        return this.deliveryStore.enqueue({
+        return this.auditAttention('automation-result', proof.automationId, { lanePurpose: { purpose: 'result' } }, this.deliveryStore.enqueue({
             idempotencyKey: `automation:${proof.occurrenceId}:${binding.id}`,
             bindingId: binding.id,
             target: { conversation: binding.conversation, principal: binding.principal },
@@ -4366,7 +5864,7 @@ export class AssistantDeliveryService extends Service {
                 'dsh.learning.outputDigest': proof.outputDigest,
                 'dsh.learning.proofDigest': proof.proofDigest,
             }),
-        });
+        }));
     }
     /** Resolve the current generation of one exact Host-owned owner route. */
     resolveOwnerRoute(authorityIdInput) {
@@ -4389,11 +5887,68 @@ export class AssistantDeliveryService extends Service {
             snapshot: ownerRouteBindingSnapshot(authority, binding),
         };
     }
+    /**
+     * Read-only Host observation of the configured owner, even after its binding
+     * has been revoked. Missing routes and transient failures are not revocation.
+     */
+    inspectOwnerRouteState(input) {
+        this.assertActive();
+        let authorityId;
+        try {
+            authorityId = canonicalOwnerRouteId(input.authorityId);
+        }
+        catch {
+            return Object.freeze({ status: 'unavailable', reason: 'authority-invalid' });
+        }
+        const authority = this.ownerRoutes.get(authorityId);
+        if (authority === undefined) {
+            return Object.freeze({ status: 'unavailable', reason: 'authority-unconfigured' });
+        }
+        const principalId = externalPrincipalId(authority.principal);
+        // Equality with the bounded, validated authority also excludes malformed
+        // scope values. Match validateOwnerRoute's NFC/trim normalization first.
+        const text = (value) => typeof value === 'string'
+            ? value.normalize('NFC').trim() : undefined;
+        if (text(input.principalId) !== principalId || text(input.workspace) !== authority.workspace
+            || text(input.agentPreset) !== authority.agentPreset) {
+            return Object.freeze({ status: 'unavailable', reason: 'scope-mismatch' });
+        }
+        try {
+            // Do not resolve an active binding before checking the durable owner:
+            // revokePrincipal/handoffOwner revoke that binding in the same transaction.
+            const owner = this.deliveryStore.getPrincipal(authority.principal);
+            if (owner?.role !== 'owner' || externalPrincipalId(owner.principal) !== principalId) {
+                return Object.freeze({ status: 'unavailable', reason: 'owner-unavailable' });
+            }
+            if (owner.status === 'revoked') {
+                return Object.freeze({ status: 'revoked', authorityId,
+                    authorityHash: ownerRouteAuthorityHash(authority), principalId,
+                    principalRecordId: owner.id, principalVersion: owner.version });
+            }
+            return Object.freeze({ status: 'active', receipt: this.validateOwnerRoute(input) });
+        }
+        catch (error) {
+            return Object.freeze({ status: 'unavailable', reason: error instanceof AssistantDeliveryError && error.code === 'missing-binding'
+                    ? 'route-unavailable' : 'inspection-unavailable' });
+        }
+    }
     /**
      * Revalidate Recovery/other Host work against the live owner route without
      * exposing a session id, conversation id, user message or delivery content.
      */
     validateOwnerRoute(input) {
+        return this.ownerRouteReceipt(input).receipt;
+    }
+    /**
+     * Host-only: the same receipt as `validateOwnerRoute`, plus the id of the
+     * exact active binding it was resolved from (one resolve, so both describe
+     * the same route state). Not an Agent tool; same `missing-binding` errors.
+     */
+    inspectOwnerRouteBinding(input) {
+        const { receipt, bindingId } = this.ownerRouteReceipt(input);
+        return Object.freeze({ protocol: 'assistant-delivery/owner-route-binding/v1', receipt, bindingId });
+    }
+    ownerRouteReceipt(input) {
         this.assertActive();
         const resolved = this.resolveOwnerRoute(input.authorityId);
         const authority = this.ownerRoutes.get(resolved.authorityId);
@@ -4423,7 +5978,7 @@ export class AssistantDeliveryService extends Service {
             || agentPreset !== authority.agentPreset) {
             throw new AssistantDeliveryError('missing-binding', 'owner route authority does not match the requested scope');
         }
-        return Object.freeze({
+        const receipt = Object.freeze({
             receiptVersion: 2,
             authorityId: resolved.authorityId,
             authorityHash: resolved.snapshot.authorityHash,
@@ -4435,6 +5990,7 @@ export class AssistantDeliveryService extends Service {
             bindingVersion: resolved.snapshot.bindingVersion,
             generation: resolved.snapshot.generation,
         });
+        return Object.freeze({ receipt, bindingId: resolved.snapshot.bindingId });
     }
     /** Host-only proof that the live caller Agent belongs to the current owner route. */
     validateOwnerAgentForRoute(agent, authorityId) {
@@ -4494,6 +6050,164 @@ export class AssistantDeliveryService extends Service {
             throw error;
         }
     }
+    /**
+     * Host-only, READ-ONLY proof that the live caller Agent is bound to an
+     * active `linked` principal whose `linked_to_id` is the CURRENT owner row of
+     * this owner route. The receipt has a distinct protocol and no
+     * `receiptVersion`, so v2 owner checks reject it; it never grants owner,
+     * approval, continuation or mutation authority. Every call re-reads the
+     * route, the root owner, the alias binding and the alias principal twice.
+     */
+    inspectOwnerAliasRoute(agent, authorityId) {
+        if (!this.active || typeof agent !== 'object' || agent === null || agent.session === undefined
+            || typeof authorityId !== 'string' || authorityId.length === 0
+            || Buffer.byteLength(authorityId) > toolApprovalIdentityBytes)
+            return undefined;
+        const agents = this.context.get('agents');
+        const sessions = this.context.get('sessions');
+        if (agents === undefined || sessions === undefined)
+            return undefined;
+        const sessionId = String(agent.session.id);
+        const liveCaller = () => String(agent.id) === sessionId
+            && agents.get(agent.id) === agent
+            && sessions.get(agent.id) === agent.session;
+        if (!liveCaller())
+            return undefined;
+        const read = () => {
+            const route = this.resolveOwnerRoute(authorityId);
+            const authority = this.ownerRoutes.get(route.authorityId);
+            const root = this.deliveryStore.getPrincipal(route.binding.principal);
+            if (authority === undefined || root?.status !== 'active' || root.role !== 'owner'
+                || JSON.stringify(root.principal) !== JSON.stringify(route.binding.principal))
+                return undefined;
+            const binding = this.deliveryStore.getBindingBySession(sessionId);
+            if (binding?.status !== 'active' || binding.sessionId !== sessionId || binding.id === route.binding.id
+                || this.deliveryStore.getActiveBinding(binding.conversation)?.id !== binding.id
+                || binding.workspace !== authority.workspace || binding.agentPreset !== authority.agentPreset
+                || agent.session.header.cwd !== binding.workspace
+                || agent.session.header.agentPreset !== binding.agentPreset)
+                return undefined;
+            const alias = this.deliveryStore.getPrincipal(binding.principal);
+            if (alias?.status !== 'active' || alias.role !== 'linked'
+                || typeof alias.linkedToId !== 'string' || alias.linkedToId !== root.id || alias.id === root.id
+                || JSON.stringify(alias.principal) !== JSON.stringify(binding.principal))
+                return undefined;
+            return Object.freeze({
+                protocol: 'assistant-delivery/owner-alias-receipt/v1',
+                authorityId: route.authorityId,
+                authorityHash: route.snapshot.authorityHash,
+                workspace: authority.workspace,
+                agentPreset: authority.agentPreset,
+                alias: Object.freeze({
+                    principalId: externalPrincipalId(alias.principal),
+                    principalRecordId: alias.id,
+                    principalVersion: alias.version,
+                    bindingId: binding.id,
+                    bindingVersion: binding.version,
+                    bindingGeneration: binding.generation,
+                    sessionId,
+                }),
+                root: Object.freeze({
+                    principalId: externalPrincipalId(root.principal),
+                    principalRecordId: root.id,
+                    principalVersion: root.version,
+                    bindingVersion: route.snapshot.bindingVersion,
+                    generation: route.snapshot.generation,
+                }),
+            });
+        };
+        try {
+            const first = read();
+            if (first === undefined)
+                return undefined;
+            const current = read();
+            return current !== undefined && liveCaller()
+                && acceptanceCanonicalJson(current) === acceptanceCanonicalJson(first) ? first : undefined;
+        }
+        catch (error) {
+            if (error instanceof AssistantDeliveryError && error.code === 'missing-binding')
+                return undefined;
+            throw error;
+        }
+    }
+    /**
+     * Host-only proof of one live, unsettled native tool call in the alias's
+     * exact claimed human Inbox turn. Read-only; it is NOT an owner foreground
+     * proof (`assistant-delivery/foreground-tool-call/v1`) and must never be
+     * accepted where one is required.
+     */
+    inspectOwnerAliasForegroundToolCall(input) {
+        if (!input || typeof input !== 'object'
+            || typeof input.authorityId !== 'string' || input.authorityId.length === 0
+            || typeof input.callId !== 'string' || input.callId.length === 0
+            || typeof input.toolName !== 'string' || input.toolName.length === 0
+            || typeof input.argumentsJson !== 'string'
+            || Buffer.byteLength(input.authorityId) > toolApprovalIdentityBytes
+            || Buffer.byteLength(input.callId) > toolApprovalIdentityBytes
+            || Buffer.byteLength(input.toolName) > toolApprovalIdentityBytes
+            || Buffer.byteLength(input.argumentsJson) > toolApprovalArgumentBytes)
+            return undefined;
+        const agent = input.agent;
+        const receipt = this.inspectOwnerAliasRoute(agent, input.authorityId);
+        if (receipt === undefined)
+            return undefined;
+        const turn = this.currentAliasTurn(agent, receipt);
+        if (turn === undefined)
+            return undefined;
+        const call = inspectUnsettledNativeCall(agent.session.snapshotEvents(), turn.turn, input.callId, input.toolName, input.argumentsJson);
+        if (call === undefined)
+            return undefined;
+        const current = this.inspectOwnerAliasRoute(agent, input.authorityId);
+        if (current === undefined || acceptanceCanonicalJson(current) !== acceptanceCanonicalJson(receipt)
+            || this.currentAliasTurn(agent, receipt) !== turn)
+            return undefined;
+        return Object.freeze({ protocol: 'assistant-delivery/owner-alias-foreground-tool-call/v1',
+            receipt, sourceInboxId: turn.sourceInboxId, sourceEventId: turn.sourceEventId, turn: turn.turn, call });
+    }
+    currentAliasTurn(agent, receipt) {
+        const turn = this.aliasTurns.get(agent);
+        if (turn === undefined || turn.sessionId !== receipt.alias.sessionId
+            || turn.bindingId !== receipt.alias.bindingId || turn.bindingVersion !== receipt.alias.bindingVersion
+            || turn.principalRecordId !== receipt.alias.principalRecordId || turn.principalVersion !== receipt.alias.principalVersion
+            || turn.linkedToId !== receipt.root.principalRecordId)
+            return undefined;
+        const binding = this.deliveryStore.getBinding(turn.bindingId);
+        const inbox = this.deliveryStore.getInbox(turn.sourceInboxId);
+        if (binding?.status !== 'active' || binding.version !== turn.bindingVersion
+            || binding.sessionId !== turn.sessionId
+            || inbox?.status !== 'claimed' || inbox.bindingId !== binding.id
+            || inbox.envelope.eventId !== turn.sourceEventId
+            || !this.isInboundAuthorized(binding, inbox.envelope))
+            return undefined;
+        const events = agent.session.snapshotEvents();
+        const started = events.some(event => event.type === 'turn/start' && event.data.turn === turn.turn);
+        const ended = events.some(event => event.type === 'turn/end' && event.data.turn === turn.turn);
+        return started && !ended ? turn : undefined;
+    }
+    captureAliasTurn(agent, sourceInput, turnInput) {
+        if (!this.active || typeof sourceInput !== 'object' || sourceInput === null
+            || !Number.isSafeInteger(turnInput) || turnInput < 0)
+            return;
+        const source = sourceInput;
+        if (source.kind !== 'delivery' || typeof source.channel !== 'string'
+            || typeof source.account !== 'string' || typeof source.eventId !== 'string')
+            return;
+        const sessionId = String(agent.session.id);
+        const binding = this.deliveryStore.getBindingBySession(sessionId);
+        const inbox = this.deliveryStore.getInboxByProviderEvent(source.channel, source.account, source.eventId);
+        const principal = binding === undefined ? undefined : this.deliveryStore.getPrincipal(binding.principal);
+        if (binding?.status !== 'active' || inbox?.status !== 'claimed' || inbox.bindingId !== binding.id
+            || binding.sessionId !== sessionId || binding.workspace !== agent.session.header.cwd
+            || binding.agentPreset !== agent.session.header.agentPreset
+            || principal?.status !== 'active' || principal.role !== 'linked' || typeof principal.linkedToId !== 'string'
+            || !this.isInboundAuthorized(binding, inbox.envelope))
+            return;
+        this.aliasTurns.set(agent, Object.freeze({
+            sessionId, bindingId: binding.id, bindingVersion: binding.version,
+            principalRecordId: principal.id, principalVersion: principal.version, linkedToId: principal.linkedToId,
+            sourceEventId: source.eventId, sourceInboxId: inbox.id, turn: turnInput,
+        }));
+    }
     /** Host-only durable ordinary-turn metadata; never registered as a model tool. */
     listOwnerForegroundTaskSources(input) {
         this.assertActive();
@@ -4512,6 +6226,12 @@ export class AssistantDeliveryService extends Service {
         this.validateOwnerRoute(input);
         return this.deliveryStore.readOwnerForegroundTaskSource(input, this.ownerRoutes.get(input.authorityId));
     }
+    /** Host-only bounded original input, independent of successful reply evidence. */
+    readOwnerForegroundTaskInput(input) {
+        this.assertActive();
+        this.validateOwnerRoute(input);
+        return this.deliveryStore.readOwnerForegroundTaskInput(input, this.ownerRoutes.get(input.authorityId));
+    }
     /** Hold Delivery's owner/source writer fence across synchronous downstream adoption. */
     withOwnerForegroundTaskSourceFence(input, callback) {
         this.assertActive();
@@ -4524,6 +6244,135 @@ export class AssistantDeliveryService extends Service {
         this.validateOwnerRoute(input);
         return this.deliveryStore.withOwnerForegroundTaskSourcesFence(input, this.ownerRoutes.get(input.authorityId), callback);
     }
+    /** One Delivery → Evaluation → WorkItems source fence; callback must be local and synchronous. */
+    withOwnerLearningSourcesFence(input, callback) {
+        this.assertActive();
+        input = learningSourceData(input);
+        if (typeof callback !== 'function' || !Array.isArray(input.sources) || input.sources.length > 1_000)
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid learning source batch');
+        // Snapshot caller data before any peer callbacks. Never retain live accessors or mutable expectations.
+        const sources = input.sources;
+        const keys = new Set(), hex = /^[a-f0-9]{64}$/u;
+        for (const source of sources) {
+            if (!source || !['foreground', 'work-item'].includes(source.kind) || !hex.test(source.expectedSourceDigest))
+                throw new AssistantDeliveryError('runtime-conflict', 'invalid learning source expectation');
+            const id = source.kind === 'foreground' ? source.inboxId : source.itemId, key = `${source.kind}:${id}`;
+            if (typeof id !== 'string' || !id || keys.has(key))
+                throw new AssistantDeliveryError('runtime-conflict', 'learning source identities must be unique');
+            keys.add(key);
+            if (source.kind === 'work-item' && (typeof source.outcomeId !== 'string' || !source.outcomeId || !hex.test(source.expectedContentDigest)
+                || !source.canonical || !Number.isSafeInteger(source.canonical.version) || source.canonical.version < 1 || !hex.test(source.canonical.digest)
+                || !['achieved', 'not-achieved'].includes(source.canonical.objectiveStatus)))
+                throw new AssistantDeliveryError('runtime-conflict', 'invalid work item learning expectation');
+        }
+        this.validateOwnerRoute(input);
+        const evaluation = this.context.get('assistantEvaluation', false);
+        if (!evaluation?.withTrustedCanonicalScopeWriterFence)
+            throw new AssistantDeliveryError('runtime-conflict', 'canonical source fence is unavailable');
+        const evaluationIdentity = workItemPeerIdentity(evaluation);
+        return this.deliveryStore.withOwnerLearningSourceFence(input, this.ownerRoutes.get(input.authorityId), () => {
+            const feedbackRegistration = sources.some(source => source.kind === 'work-item') ? this.currentWorkItemReplyConsumer() : undefined;
+            const prepared = sources.map(source => {
+                if (source.kind !== 'work-item')
+                    return undefined;
+                const state = this.ownerWorkItemLearningTaskState({ ...input, outcomeId: source.outcomeId });
+                return state ? { ...state, task: learningSourceData(state.task), revision: learningSourceData(state.revision), resolved: { ...state.resolved, proof: learningSourceData(state.resolved.proof) } } : undefined;
+            });
+            const peer = this.context.get('assistantWorkItems', false);
+            const peerIdentity = workItemPeerIdentity(peer);
+            const scope = evaluation.canonicalHostScope({ workspace: input.workspace, preset: input.agentPreset });
+            const { scopeWatermark } = evaluation.listTrustedTaskLearningProjections({ scope, limit: 1 });
+            const fenced = evaluation.withTrustedCanonicalScopeWriterFence({ scope, scopeWatermark }, () => {
+                const active = prepared.flatMap((state, index) => state ? [{ state, index }] : []);
+                const finish = (proofs) => {
+                    proofs = learningSourceData(proofs);
+                    if (!Array.isArray(proofs) || proofs.length !== active.length)
+                        throw new AssistantDeliveryError('runtime-conflict', 'work item proof batch is misaligned');
+                    if (!this.active || workItemPeerIdentity(this.context.get('assistantEvaluation', false)) !== evaluationIdentity
+                        || workItemPeerIdentity(this.context.get('assistantWorkItems', false)) !== peerIdentity)
+                        throw new AssistantDeliveryError('runtime-conflict', 'learning source provider changed');
+                    const owner = this.validateOwnerRoute(input);
+                    if (owner.authorityHash !== input.expectedOwner.authorityHash || owner.principalRecordId !== input.expectedOwner.principalRecordId
+                        || owner.principalVersion !== input.expectedOwner.principalVersion)
+                        throw new AssistantDeliveryError('runtime-conflict', 'learning source owner changed');
+                    const available = new Map();
+                    for (const [offset, { state, index }] of active.entries()) {
+                        const proof = proofs[offset], expectation = sources[index];
+                        if (expectation.kind !== 'work-item' || !proof || workItemReplyCanonical(proof) !== workItemReplyCanonical(state.resolved.proof))
+                            continue;
+                        const current = evaluation.getTrustedWorkItemLearningProjection({ scope, itemId: expectation.itemId });
+                        const revision = evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId: expectation.outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+                        if (state.resolved.peerIdentity !== peerIdentity || workItemReplyCanonical(current) !== workItemReplyCanonical(state.task.canonical)
+                            || workItemReplyCanonical(revision) !== workItemReplyCanonical(state.revision) || state.task.proofIdentity.itemId !== expectation.itemId
+                            || state.task.sourceDigest !== expectation.expectedSourceDigest || state.task.presentationDigest !== expectation.expectedContentDigest
+                            || !current?.objective || current.objective.outcomeId !== expectation.outcomeId || current.projection.version !== expectation.canonical.version
+                            || current.projection.digest !== expectation.canonical.digest || current.objective.status !== expectation.canonical.objectiveStatus)
+                            continue;
+                        try {
+                            this.workItemFeedbackFence(state.intent, true, state.resolved.registration);
+                        }
+                        catch {
+                            continue;
+                        }
+                        available.set(index, Object.freeze({ ...state.task, owner }));
+                    }
+                    // Every foreign owns/resolve callback has finished. Only native local source/canonical/Policy reads remain.
+                    const snapshots = Object.freeze(sources.map((source, index) => {
+                        if (source.kind === 'work-item') {
+                            let currentCanonical = evaluation.getTrustedWorkItemLearningProjection({ scope, itemId: source.itemId });
+                            const outcomeId = currentCanonical?.objective?.outcomeId;
+                            let ownerRevision = outcomeId === undefined ? undefined : evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+                            const intent = ownerRevision?.operationId === undefined ? undefined : this.deliveryStore.workItemFeedback.findOutcome(ownerRevision.outcomeId, ownerRevision.operationId);
+                            let authorized = false;
+                            if (feedbackRegistration && currentCanonical?.projection.subjectKind === 'work-item' && currentCanonical.projection.subjectRef === source.itemId
+                                && intent && intent.source.target.itemId === source.itemId && intent.source.owner.principalRecordId === owner.principalRecordId
+                                && intent.source.owner.principalVersion === owner.principalVersion) {
+                                try {
+                                    this.workItemFeedbackFence(intent, true, feedbackRegistration);
+                                    authorized = true;
+                                }
+                                catch { /* Temporarily unavailable sources do not expose another owner's canonical state. */ }
+                            }
+                            if (!authorized) {
+                                currentCanonical = undefined;
+                                ownerRevision = undefined;
+                            }
+                            return Object.freeze({ kind: 'work-item', itemId: source.itemId, task: authorized ? available.get(index) : undefined, currentCanonical, ownerRevision });
+                        }
+                        const content = this.deliveryStore.readOwnerForegroundTaskSource({ ...input, ...source }, this.ownerRoutes.get(input.authorityId));
+                        const ownedSource = this.deliveryStore.inspectOwnerForegroundTaskSource({ ...input, inboxId: source.inboxId }, this.ownerRoutes.get(input.authorityId));
+                        const currentCanonical = ownedSource === undefined ? undefined : evaluation.getTrustedForegroundLearningProjection({ scope, inboxId: source.inboxId });
+                        const outcomeId = currentCanonical?.objective?.outcomeId ?? currentCanonical?.execution?.outcomeId;
+                        const ownerRevision = outcomeId === undefined ? undefined : evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+                        const task = outcomeId === undefined ? undefined : this.inspectOwnerForegroundLearningTask({ ...input, outcomeId });
+                        return Object.freeze({ kind: 'foreground', inboxId: source.inboxId, content, currentCanonical, ownerRevision, task });
+                    }));
+                    return callback(snapshots);
+                };
+                if (!active.length)
+                    return finish([]);
+                if (!peer?.withOwnerWorkItemFeedbackTargetsFence)
+                    throw new AssistantDeliveryError('runtime-conflict', 'work item batch source fence is unavailable');
+                return peer.withOwnerWorkItemFeedbackTargetsFence(active.map(({ state }) => state.resolved.capability), finish);
+            });
+            if (!fenced.matched)
+                throw new AssistantDeliveryError('runtime-conflict', 'canonical source scope changed');
+            return fenced.value;
+        });
+    }
+    /** Strict single-source wrapper: unavailable or changed sources never invoke the callback. */
+    withOwnerWorkItemLearningTaskFence(input, callback) {
+        input = learningSourceData(input);
+        if (typeof callback !== 'function')
+            throw new AssistantDeliveryError('runtime-conflict', 'invalid learning source callback');
+        return this.withOwnerLearningSourcesFence({ ...input, sources: [{ kind: 'work-item', itemId: input.itemId, outcomeId: input.outcomeId,
+                    expectedSourceDigest: input.expectedSourceDigest, expectedContentDigest: input.expectedContentDigest, canonical: input.canonical }] }, sources => {
+            const source = sources[0];
+            if (!source || source.kind !== 'work-item' || !source.task)
+                throw new AssistantDeliveryError('runtime-conflict', 'work item learning source is unavailable or changed');
+            return callback(source.task);
+        });
+    }
     /** Host-only snapshot of the model selected for this owner's external conversation. */
     inspectOwnerModelSelection(input) {
         this.validateOwnerRoute(input);
@@ -4555,10 +6404,194 @@ export class AssistantDeliveryService extends Service {
             ...(selected.reasoningEffort === undefined ? {} : { reasoningEffort: selected.reasoningEffort }) });
     }
     /**
-     * Resolve one canonical foreground result against its actual owner lineage.
+     * Resolve one canonical work-item result against its actual owner lineage.
      * Evaluation's workspace/preset scope alone does not establish ownership.
      * Historical Sessions remain eligible after /new, but not after owner ABA.
      */
+    inspectOwnerWorkItemLearningTask(input) {
+        return this.ownerWorkItemLearningTaskState(input)?.task;
+    }
+    ownerWorkItemLearningTaskState(input) {
+        this.assertActive();
+        const owner = this.validateOwnerRoute(input);
+        const evaluation = this.context.get('assistantEvaluation', false);
+        if (!evaluation || typeof evaluation.getTrustedWorkItemLearningProjection !== 'function')
+            return undefined;
+        const scope = evaluation.canonicalHostScope({ workspace: input.workspace, preset: input.agentPreset });
+        const canonical = evaluation.getTrustedTaskLearningProjection({ scope, outcomeId: input.outcomeId });
+        if (!canonical || canonical.projection.subjectKind !== 'work-item' || canonical.projection.disposition !== 'upsert' || !canonical.objective
+            || canonical.objective.outcomeId !== input.outcomeId || canonical.objective.source.kind !== 'user-feedback' || canonical.objective.source.id !== 'assistant-delivery/typed-owner-feedback' || canonical.objective.status === 'unknown')
+            return undefined;
+        const revision = evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId: input.outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+        if (!revision || revision.action === 'withdraw' || !revision.operationId || revision.outcomeId !== canonical.objective.outcomeId || revision.objectiveStatus !== canonical.objective.status)
+            return undefined;
+        const intent = this.deliveryStore.workItemFeedback.findOutcome(revision.outcomeId, revision.operationId);
+        if (!intent || intent.source.target.itemId !== canonical.projection.subjectRef || intent.source.owner.principalRecordId !== owner.principalRecordId || intent.source.owner.principalVersion !== owner.principalVersion)
+            return undefined;
+        let resolved;
+        try {
+            resolved = this.workItemFeedbackProof(intent, true);
+        }
+        catch {
+            return undefined;
+        }
+        if (!resolved)
+            return undefined;
+        const proof = resolved.proof;
+        if (proof.owner.ownerRouteId !== owner.authorityId || proof.owner.principalId !== owner.principalId || !canonical.execution
+            || canonical.execution.status !== proof.production.executionStatus
+            || !canonical.execution.evidence.some(ref => ref.kind === 'work-item-production-proof' && ref.ref === proof.production.runId && ref.digest === proof.proofDigest)
+            || !canonical.objective.evidence.some(ref => ref.kind === 'work-item-report' && ref.ref === `${proof.itemId}#${proof.reportRevision}` && ref.digest === proof.reportDigest)
+            || !canonical.objective.evidence.some(ref => ref.kind === 'delivery-outbox' && ref.ref === intent.source.target.outboxId))
+            return undefined;
+        const { task, report, ...proofIdentity } = proof;
+        const brief = redactOwnerLearningReply(task.brief, 4096), visibleReport = redactOwnerLearningReply(report.text, 4096), feedback = redactOwnerLearningReply(intent.source.inputText, 4096);
+        const presentation = { brief: { ...brief, truncated: brief.truncated || task.briefTruncated }, report: { ...visibleReport, truncated: visibleReport.truncated || report.truncated }, feedback: { inboxId: intent.source.inboxId, ...feedback } };
+        // Current route/session is an authorization check, never part of immutable historical source identity.
+        const sourceDigest = workItemReplyDigest({ protocol: 'assistant-delivery/owner-work-item-learning-source/v1', sourceDigest: intent.sourceDigest, proofDigest: proof.proofDigest,
+            projection: canonical.projection, ownerRevision: { version: revision.version, action: revision.action, operationId: revision.operationId } });
+        try {
+            const final = this.workItemFeedbackProof(intent, true), current = evaluation.getTrustedTaskLearningProjection({ scope, outcomeId: input.outcomeId });
+            const currentRevision = evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId: input.outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+            if (!final || final.proof.proofDigest !== proof.proofDigest || workItemReplyCanonical(current) !== workItemReplyCanonical(canonical)
+                || workItemReplyCanonical(currentRevision) !== workItemReplyCanonical(revision) || workItemReplyCanonical(this.validateOwnerRoute(input)) !== workItemReplyCanonical(owner))
+                return undefined;
+            if (final.registration !== resolved.registration || final.peerIdentity !== resolved.peerIdentity
+                || workItemPeerIdentity(this.context.get('assistantWorkItems', false)) !== final.peerIdentity
+                || workItemPeerIdentity(this.context.get('assistantEvaluation', false)) !== workItemPeerIdentity(evaluation))
+                return undefined;
+            this.workItemFeedbackFence(intent, true, final.registration);
+        }
+        catch {
+            return undefined;
+        }
+        const learningTask = Object.freeze({ protocol: 'assistant-delivery/owner-work-item-learning/v1', owner, canonical, judgement: 'owner-feedback',
+            ownerRevision: { version: revision.version, action: revision.action, operationId: revision.operationId }, proofIdentity, sourceDigest, presentation, presentationDigest: workItemReplyDigest(presentation) });
+        return { task: learningTask, intent, resolved, evaluation, revision };
+    }
+    /** Host-only complete historical objective; old feedback and Memory identities are not reinterpreted. */
+    inspectOwnerWorkItemEngineeringContext(input) {
+        try {
+            return this.withOwnerWorkItemEngineeringContextSource(input, undefined, ({ task, manifest }) => Object.freeze({ task, manifest }));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /** Every page, including the last, revalidates the entire exact source frame. */
+    readOwnerWorkItemEngineeringContext(input) {
+        try {
+            const read = engineeringContextData(input);
+            return this.withOwnerWorkItemEngineeringContextSource(read, read, source => pageWorkItemEngineeringContext(source, source.material, read));
+        }
+        catch {
+            return undefined;
+        }
+    }
+    withOwnerWorkItemEngineeringContextFence(input, callback) {
+        if (typeof callback !== 'function')
+            throw new AssistantDeliveryError('runtime-conflict', 'engineering context callback is required');
+        return this.withOwnerWorkItemEngineeringContextSource(input, input, ({ task, manifest, objective }) => callback(Object.freeze({ task, manifest, objective })));
+    }
+    withOwnerWorkItemEngineeringContextSource(input, expectation, callback) {
+        this.assertActive();
+        input = engineeringContextData(input);
+        const expected = expectation === undefined ? undefined : engineeringContextData(expectation);
+        const unavailable = () => { throw new AssistantDeliveryError('runtime-conflict', 'work item engineering context is unavailable or changed'); };
+        const state = this.ownerWorkItemLearningTaskState(input);
+        if (!state || state.task.proofIdentity.itemId !== input.itemId)
+            return unavailable();
+        const task = learningSourceData(state.task), proof = learningSourceData(state.resolved.proof), revision = learningSourceData(state.revision);
+        const evaluation = state.evaluation, evaluationIdentity = workItemPeerIdentity(evaluation);
+        const peer = this.context.get('assistantWorkItems', false);
+        const peerIdentity = workItemPeerIdentity(peer);
+        if (!peer?.issueOwnerWorkItemEngineeringTarget || !peer.resolveOwnerWorkItemEngineeringTarget || !peer.withOwnerWorkItemEngineeringTargetsFence
+            || peerIdentity !== state.resolved.peerIdentity)
+            return unavailable();
+        // Discover the sealed root before acquiring Delivery. The final producer frame rechecks this exact opaque capability.
+        const capability = peer.issueOwnerWorkItemEngineeringTarget(state.resolved.capability);
+        if (capability === undefined)
+            return unavailable();
+        const material = validateWorkItemEngineeringMaterial(peer.resolveOwnerWorkItemEngineeringTarget(capability));
+        if (material.itemId !== input.itemId || material.feedbackProofDigest !== proof.proofDigest)
+            return unavailable();
+        const root = material.nodes[0].input;
+        return this.deliveryStore.withOwnerLearningSourceFence(input, this.ownerRoutes.get(input.authorityId), () => {
+            const rootText = () => {
+                const owner = this.validateOwnerRoute(input);
+                const source = this.deliveryStore.inspectOwnerForegroundTaskSource({ ...input, inboxId: root.inboxId }, this.ownerRoutes.get(input.authorityId));
+                const inbox = this.deliveryStore.getInbox(root.inboxId);
+                if (!source || !inbox || inbox.envelope.kind !== 'text' || !inbox.envelope.text.trim() || (inbox.envelope.attachments?.length ?? 0) > 0 || source.sourceDigest !== root.sourceDigest || source.execution.executionRef !== root.executionRef
+                    || source.completionSequence !== root.completionSequence || source.binding.id !== root.binding.id || source.binding.version !== root.binding.version
+                    || source.binding.generation !== root.binding.generation || owner.generation < root.binding.generation
+                    || source.owner.principalRecordId !== owner.principalRecordId || source.owner.principalVersion !== owner.principalVersion)
+                    return unavailable();
+                return inbox.envelope.text;
+            };
+            const ownerInputs = () => {
+                const text = rootText(), owner = this.validateOwnerRoute(input);
+                let previous = root.binding;
+                for (const [index, node] of material.nodes.entries()) {
+                    if (index === 0)
+                        continue;
+                    if (node.planProtocol !== 'assistant-work-items/owner-continuation-plan/v2' || node.input.kind !== 'continuation' || !node.input.replyId || !node.parent)
+                        return unavailable();
+                    const source = this.deliveryStore.workItemReplies.inspectHistoricalSource({ id: node.input.replyId, expectedSourceDigest: node.input.sourceDigest });
+                    const inbox = source === undefined ? undefined : this.deliveryStore.getInbox(source.id), binding = source === undefined ? undefined : this.deliveryStore.getBinding(source.binding.id);
+                    const body = material.continuationInputs[index - 1];
+                    if (!source || !inbox || !binding || !source.child || source.child.itemId !== node.itemId || source.child.planDigest !== node.planDigest
+                        || source.executionParentItemId !== node.parent.itemId || source.inputSha256 !== node.input.inputSha256 || source.inputBytes !== node.input.inputBytes
+                        || source.inputText !== body.text || inbox.envelope.kind !== 'text' || !inbox.envelope.text.trim() || (inbox.envelope.attachments?.length ?? 0) > 0
+                        || source.owner.principalRecordId !== owner.principalRecordId || source.owner.principalVersion !== owner.principalVersion || source.principalId !== input.principalId
+                        || source.scope.workspace !== input.workspace || source.scope.preset !== input.agentPreset || source.binding.generation > owner.generation
+                        || source.binding.generation < previous.generation || (source.binding.generation === previous.generation && (source.binding.id !== previous.id || source.binding.version !== previous.version))
+                        || binding.generation !== source.binding.generation || !(binding.status === 'active' && binding.version === source.binding.version || binding.status === 'revoked' && binding.version === source.binding.version + 1)
+                        || externalPrincipalId(binding.principal) !== input.principalId || binding.workspace !== input.workspace || binding.agentPreset !== input.agentPreset
+                        || workItemReplyCanonical(inbox.envelope.principal) !== workItemReplyCanonical(binding.principal) || workItemReplyCanonical(inbox.envelope.conversation) !== workItemReplyCanonical(binding.conversation))
+                        return unavailable();
+                    previous = source.binding;
+                }
+                return text;
+            };
+            const initial = frameWorkItemEngineeringContext(material, ownerInputs());
+            const scope = evaluation.canonicalHostScope({ workspace: input.workspace, preset: input.agentPreset });
+            const { scopeWatermark } = evaluation.listTrustedTaskLearningProjections({ scope, limit: 1 });
+            const result = evaluation.withTrustedCanonicalScopeWriterFence({ scope, scopeWatermark }, () => peer.withOwnerWorkItemEngineeringTargetsFence([capability], materials => {
+                if (!Array.isArray(materials) || materials.length !== 1)
+                    return unavailable();
+                const currentMaterial = validateWorkItemEngineeringMaterial(materials[0]);
+                if (workItemReplyCanonical(currentMaterial) !== workItemReplyCanonical(material))
+                    return unavailable();
+                // No owns, issue, resolve or other opaque producer callbacks below this point.
+                const owner = this.validateOwnerRoute(input);
+                if (!this.active || owner.authorityHash !== input.expectedOwner.authorityHash || owner.principalRecordId !== input.expectedOwner.principalRecordId
+                    || owner.principalVersion !== input.expectedOwner.principalVersion || workItemPeerIdentity(this.context.get('assistantWorkItems', false)) !== peerIdentity
+                    || workItemPeerIdentity(this.context.get('assistantEvaluation', false)) !== evaluationIdentity)
+                    return unavailable();
+                this.workItemFeedbackFence(state.intent, true, state.resolved.registration);
+                const canonical = evaluation.getTrustedWorkItemLearningProjection({ scope, itemId: input.itemId });
+                const currentRevision = evaluation.inspectTrustedTaskOwnerRevision({ scope, outcomeId: input.outcomeId, principalRecordId: owner.principalRecordId, principalVersion: owner.principalVersion });
+                if (!canonical?.objective || canonical.projection.subjectKind !== 'work-item' || canonical.projection.subjectRef !== input.itemId
+                    || canonical.objective.outcomeId !== input.outcomeId || workItemReplyCanonical(canonical.projection) !== workItemReplyCanonical(task.canonical.projection)
+                    || workItemReplyCanonical(canonical.objective) !== workItemReplyCanonical(task.canonical.objective)
+                    || workItemReplyCanonical(canonical.execution) !== workItemReplyCanonical(task.canonical.execution)
+                    || workItemReplyCanonical(currentRevision) !== workItemReplyCanonical(revision))
+                    return unavailable();
+                const frame = frameWorkItemEngineeringContext(currentMaterial, ownerInputs());
+                if (frame.manifest.manifestDigest !== initial.manifest.manifestDigest || currentMaterial.feedbackProofDigest !== proof.proofDigest)
+                    return unavailable();
+                if (expected && (task.sourceDigest !== expected.expectedSourceDigest || task.presentationDigest !== expected.expectedContentDigest
+                    || canonical.projection.version !== expected.canonical.version || canonical.projection.digest !== expected.canonical.digest
+                    || canonical.objective.status !== expected.canonical.objectiveStatus || frame.manifest.manifestDigest !== expected.expectedManifestDigest
+                    || frame.manifest.objective.fullTextDigest !== expected.expectedObjectiveDigest))
+                    return unavailable();
+                return callback(Object.freeze({ task: Object.freeze({ ...task, owner, canonical }), manifest: frame.manifest, objective: frame.objective, material: currentMaterial }));
+            }));
+            if (!result.matched)
+                return unavailable();
+            return result.value;
+        });
+    }
     inspectOwnerForegroundLearningTask(input) {
         this.assertActive();
         const routeInput = { authorityId: input.authorityId, principalId: input.principalId,
@@ -4695,18 +6728,23 @@ export class AssistantDeliveryService extends Service {
         }
         const resolved = this.resolveOwnerRoute(input.authorityId);
         const authority = this.ownerRoutes.get(resolved.authorityId);
+        const prepare = () => this.prepareAttentionDelivery({ lane: 'background-route', envelope: input.attention, sourceId,
+            binding: () => this.deliveryStore.getActiveBinding(authority.conversation),
+            idempotencyKey, text: input.text, format: input.format ?? 'plain' });
+        // Stage 3: reject before Policy writes its allow row or spends budget (see enqueueBackgroundAuthorized).
+        const early = this.config.attentionEnforce === true ? prepare() : undefined;
         const decision = authorizeOwnerRoute(this.policy, authority, sourceId, idempotencyKey);
         if (decision.effect !== 'allow')
             throw policyDenied(decision);
+        const delivered = early ?? prepare();
         try {
-            return this.deliveryStore.enqueueOwnerRoute({
+            return this.auditAttention('background-route', sourceId, { envelope: input.attention }, this.deliveryStore.enqueueOwnerRoute({
                 authority,
                 sourceId,
                 sourceHash: createHash('sha256').update(sourceId).digest('hex'),
                 idempotencyKey,
-                text: input.text,
-                format: input.format ?? 'plain',
-            });
+                ...delivered,
+            }));
         }
         catch (error) {
             if (error instanceof DeliveryStoreError && error.code === 'invalid-binding') {
@@ -5197,7 +7235,9 @@ export class AssistantDeliveryService extends Service {
         }
     }
     async tick() {
-        this.assertActive();
+        // Timer-driven entry: a tick that fires after dispose is a no-op, not an error.
+        if (!this.active)
+            return;
         await this.drainInboundAdmissions();
         this.drainRestartContinuations();
         const restartFence = this.deliveryStore.getRestartFence();
@@ -5218,6 +7258,7 @@ export class AssistantDeliveryService extends Service {
         await this.drainDeliveryPresentations();
         await this.drainPreferenceProjections();
         await this.drainNaturalObjectiveIntents();
+        await this.drainWorkItemFeedback();
         await this.drainWorkflowTraces();
     }
     async whenIdle() {
@@ -5229,6 +7270,7 @@ export class AssistantDeliveryService extends Service {
             this.presentationFlight,
             this.preferenceProjectionFlight,
             this.naturalObjectiveFlight,
+            this.workItemFeedbackFlight,
             this.workflowTraceFlight,
             this.inboundAdmissionRecoveryFlight,
             this.interruptedInboxNoticeFlight,
@@ -5434,6 +7476,13 @@ export class AssistantDeliveryService extends Service {
             if (binding === undefined)
                 continue;
             if (!reset && !stop) {
+                // A pending owner-question reply is finished (or held for a retry)
+                // before it can be queued to the Agent.
+                const attentionReply = this.inspectOwnerQuestionReply(pending, binding);
+                if (attentionReply === 'handled')
+                    continue;
+                if (attentionReply === 'transient')
+                    return;
                 this.deliveryStore.queueInbox(pending.id, binding.id);
                 continue;
             }
@@ -5505,7 +7554,7 @@ export class AssistantDeliveryService extends Service {
         this.bindingFlights.set(key, promise);
         return promise;
     }
-    async stopInternal() {
+    clearSchedulerTimers() {
         if (this.timer !== undefined)
             clearInterval(this.timer);
         if (this.modelSelectionRetryTimer !== undefined)
@@ -5518,6 +7567,9 @@ export class AssistantDeliveryService extends Service {
         this.modelSelectionRetryTimer = undefined;
         this.workflowTraceRetryTimer = undefined;
         this.preferenceProjectionRetryTimer = undefined;
+    }
+    async stopInternal() {
+        this.clearSchedulerTimers();
         this.cancelModelSelectionWaiters();
         this.inboundAdmissionRecoveryController.abort(new Error('assistant-delivery is stopping'));
         this.restartController.abort(new Error('assistant-delivery is stopping'));
@@ -5538,6 +7590,7 @@ export class AssistantDeliveryService extends Service {
             this.presentationFlight,
             this.preferenceProjectionFlight,
             this.naturalObjectiveFlight,
+            this.workItemFeedbackFlight,
             this.workflowTraceFlight,
             this.restartFlight,
         ]);